Overview

overview

7

Static

static

3

57130d7b12...2a.exe

windows10-2004-x64

7

57130d7b12...2a.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 21:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
  • Size 5.5MB
  • Sample260922-1evd5asgla
  • SHA256 57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD7.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1924
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1033.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2636
          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3044
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a135F.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4636
              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:2600
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a169B.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6088
                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:4848
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A06.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3680
                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2572
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D81.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:352
                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:6000
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20BD.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3424
                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:5544
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DDC.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5616
                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4260
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FE0.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:2392
                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:2412
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43A6.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3396
                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5124
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a478E.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:3504
                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4072
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E64.bat
                                                  24⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4084
                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:832
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2988
                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4612
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53A4.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4932
                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:964
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58E4.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1500
                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4104
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a619E.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3116
                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:960
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64BB.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:3764
                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:120
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67B9.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3648
                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4584
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B14.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5340
                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5052
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F89.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2200
                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5180
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7100.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5064
                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1880
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73DE.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2936
                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3472
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74C9.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5896
                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:3368
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75D2.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3252
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1424
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7749.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3844
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4208
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7862.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4888
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4136
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a795C.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3544
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2036
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A76.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:708
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1268
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B8F.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4652
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3224
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CA8.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2248
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3520
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DD1.bat
                                                                                                                              62⤵
                                                                                                                                PID:1332
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:2052
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F0A.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:5000
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:3888
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8042.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4380
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:5800
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:5676
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:5924
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8284.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:4700
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:4884
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a837E.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:2000
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:292
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8497.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:4796
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:2008
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85C0.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:1072
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:2120
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86BA.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:1852
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:5524
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87A5.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                                PID:2460
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:4500
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a888F.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                      PID:3772
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:3920
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8989.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                            PID:760
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:5856
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A54.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                  PID:236
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B3F.bat
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                        PID:2980
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                          89⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C48.bat
                                                                                                                                                                                                            90⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:4496
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5092
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D52.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:1316
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E5B.bat
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:5792
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1556
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F36.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                          PID:836
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:600
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9030.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:4720
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:800
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91F5.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92EF.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:5304
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:1200
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                  PID:4984
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:5244
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94C4.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:5860
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:1732
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95CE.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                            PID:5564
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              PID:2972
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96C8.bat
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:2328
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5380
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97A2.bat
                                                                                                                                                                                                                                                                    114⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:1136
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                      115⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:5344
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987D.bat
                                                                                                                                                                                                                                                                        116⤵
                                                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:5032
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9958.bat
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                                PID:2984
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A13.bat
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:1604
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B1D.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:4508
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C56.bat
                                                                                                                                                                                                                                                                                            124⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:3196
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D21.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                PID:436
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                  PID:252
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                                                                                                                                                                                                                                                                                    128⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:5660
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F34.bat
                                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                          PID:4444
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                              PID:2424
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA00F.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:3556
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                    PID:4668
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA109.bat
                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                        PID:2552
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:1220
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA212.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:2712
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              PID:5056
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2DD.bat
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:3320
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3A9.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:4064
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:2032
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4A3.bat
                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                          PID:2616
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:5444
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA58D.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                PID:924
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5264
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA781.bat
                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3068
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8B9.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5560
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1768
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA975.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5568
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:4284
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA8E.bat
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4908
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2504
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB88.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5372
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                      155⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC53.bat
                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD0F.bat
                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                          160⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE76.bat
                                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:912
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB174.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB22F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB462.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB75F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB82B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB992.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB96.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC058.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC114.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC25C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC48E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC74E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC809.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC961.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFBA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD066.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD102.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD25A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD315.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD45D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD632.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD74B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD874.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD98D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAB6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE063.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE10F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE19C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE229.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE342.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:248
                                                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                              • Creates a file in the Startup directory
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                              PID:5772
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                PID:2900
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:5700

                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                  $$a1033.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1033.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 2aded304c563d3d3bcce77643b7fe4d6e35f88ff191e7d495b9827019c3a8d23
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a135F.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a135F.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 e28f3c3bb03b8bfea35c41b343d2f8d62504bb10066877c10d260c83322ac2a4
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a169B.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a169B.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 f838bff9e965c1b5fe55286cc2cc7052cb014f6b8f79070180775a5b201ebd3f
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a1A06.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1A06.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 8b6e50d7b1880f5cfb4847b31168908096ac99d8540b6d0bf69bf6e01d79faf0
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a1D81.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a1D81.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 a65ccd3c54e3cdbdd09e3f0615c6db6fe71876321c91faaac6bc65c1615e624e
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a20BD.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a20BD.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 9a4def082aa786eb1a8bfd613c89891ba4e9bad2ad7aa7e40256ef5d1eb8bfc5
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a2DDC.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2DDC.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 bf2b78149be9bff76ca1c14bae1a875688e6d5e9c564e2dc120a49326d1c41d2
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a2FE0.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a2FE0.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 ce67d57fee469475b3132b3f828dfc8afcd87ff830bbe334d45a906d7398600b
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a43A6.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a43A6.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 1dc2283da070b0a68e688506c78b1f97b958b0e02217d000ca733614c8e0c285
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a478E.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a478E.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 a13ec8ef2146c564207e646e1dd48a89350234181fd8cd5c27ae5fdbfea08ae6
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a4E64.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a4E64.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 990ca9e0d796e0e6da0048151971b2a5d5ca6fa3fc98304c328d8b2e074272b3
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a50C6.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a50C6.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 49ba0a8c3574caabb476c767b81930e659259d25cceb801776146cc0e026110b
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a53A4.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a53A4.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 bf3d79aedf5647e17d226c304b1857d813b86957bb4b6eadbb6eceb90c8197e4
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a58E4.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a58E4.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 5707d7842e51e8bd35a71c1b7b905c3642bef7f12e9d9256451d9d8c8c322dd1
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a619E.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a619E.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 fe9f11e53fe04e52f8bd02f789c13bd61e9772493b10d6f96328934c0581205f
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a64BB.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a64BB.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 c5c52e30d1f5c51681483b6ee5021e3dd55557722330fd709d6bfcf76c9f4b96
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a67B9.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a67B9.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 662ebdd66a2c2bee37538df7470c9360c849e884b0b4b906a3f8b5526753945f
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a6B14.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6B14.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 412f5a8f7cd699726b0a5910b300e0240a143614c0e0cc7385470704b1e2eaa7
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a6F89.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a6F89.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 ea8ed52226b5302b1547442ae4c0b765428c166533700d3dda95e6eba135f577
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$a7100.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$a7100.bat
                                                                                                                                                                                                                                                  • Size 722B
                                                                                                                                                                                                                                                  • SHA256 125a04427359dcf06bcc52786ba785e3fc260a8bd11d3504194526df36328bee
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  $$aCD7.bat
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\$$aCD7.bat
                                                                                                                                                                                                                                                  • Size 721B
                                                                                                                                                                                                                                                  • SHA256 1efb5392df192ff829235b900a7c52ec7c2ba3268d9c3d6bad798d99a60199c8
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                  • SHA256 61f3036b3337023759ef580df8a3342894606a55b37450d2caf0acf0cbef2d12
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                  • SHA256 30d490b7005acce375f7f5277c7a64cc3872dcc275439642cd3c0268e260cad3
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                  • SHA256 cc3a209347a135a1bdeb4503723002e6f3999618c848c96e5d78276ab60b3076
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                  • SHA256 8451aaef2cca5c19aaae7f5d49c0b442cecf2916c1df05eaaa2941fdb8f03be9
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                  • SHA256 41ca2f0378e9d972f4daf76f58c692aec6c0a04e5355eeacb158230fb9186cc3
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                  • SHA256 db97a19d036983288fdde407734e0e8defe62b8b4193a5f0c051e90e1ea35c7e
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.0MB
                                                                                                                                                                                                                                                  • SHA256 71a04a75eddec860fd765302e034d91c054ad4dc8c403c8c742a7e5121223469
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                                                  • SHA256 7184aee40dbd19c99ec684afeb577e2145d840885a5f19ed922ce55afb2680d8
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 4.9MB
                                                                                                                                                                                                                                                  • SHA256 6ddefa35e729bb8a8b586891b8647775a1fb849d0d35291d7638c68d010e523a
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                  • SHA256 5bdaa826bba7725d1e06672d5086fb8007245ddb53f597864bafff6cd677ac40
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.5MB
                                                                                                                                                                                                                                                  • SHA256 c3cc84ec77e53a8e426c4e99d82211186eb91a34818f034f82be327a736afe3b
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                  • SHA256 ac0f5a19694d4df5cdedaec21043fdf9a39f8b7237e6cf64c89bf6d848f40e49
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.5MB
                                                                                                                                                                                                                                                  • SHA256 d351a2fd42325bd6f1bf74798397f515a87e861029c940f513943ff7fee229eb
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                  • SHA256 539106f1a98ab3ce6832d181ca37ab7dbb19111026990426607d568efa932fc7
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                  • SHA256 0a69f28e6b1c750d7247916885bca9b4efd749fb52ef31894199e62b484dce84
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                  • SHA256 2e9e7457b9926b1f9d1849beb0dcb4d4a7429a5e723b61591d817b685ecfb14d
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                  • SHA256 bef8a1e9b4c3bb426d66f46b2014e29f9425d97651f6b6f2c6c2de991537e4c1
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.3MB
                                                                                                                                                                                                                                                  • SHA256 89a1ab4ec5618625508c5485cc83d3a9784ddd041696006ec135948417c1c469
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.2MB
                                                                                                                                                                                                                                                  • SHA256 4c0e0029142416c83bebf13edc67f39927624f65128d8b94f40584dca9e22358
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a.exe.exe
                                                                                                                                                                                                                                                  • Size 5.1MB
                                                                                                                                                                                                                                                  • SHA256 ff26bd5c22af0da989817042763825801e506d046b1c829ba69b9823c659ff58
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  Logo1_.exe
                                                                                                                                                                                                                                                  • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                                                  • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  _desktop.ini
                                                                                                                                                                                                                                                  • Path F:\$RECYCLE.BIN\S-1-5-21-4280978039-528710165-233981602-1000\_desktop.ini
                                                                                                                                                                                                                                                  • Size 9B
                                                                                                                                                                                                                                                  • SHA256 110df0648174cdd0f59f03074b074dd0856b75a6bb090739d1ea81587092e15a
                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                  memory/120-8073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/252-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/292-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/564-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/600-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/680-8816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/724-8792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/832-6045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/960-8063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/964-6362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1064-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1092-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1200-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1220-8340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1268-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1316-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1408-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1424-8118-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1432-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1556-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1604-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1632-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1668-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1732-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1768-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1880-8103-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1924-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1924-2391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1988-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/1996-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2008-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2032-8358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2036-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2052-8153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2060-8701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2064-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2120-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2156-8726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2244-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2280-8750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2332-8659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2336-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2380-8798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2388-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2408-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2412-5175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2424-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2444-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2500-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2504-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2572-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2600-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2656-8641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2736-8852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2788-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2828-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2848-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2856-8322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2864-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2908-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2964-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/2972-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3032-8707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3044-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3048-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3136-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3140-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3184-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3224-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3300-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3332-8738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3368-8113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3436-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3472-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3520-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3536-8828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3548-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3632-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3692-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3732-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3760-8840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3804-8846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3848-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3888-8158-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/3920-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4072-6037-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4104-8055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4136-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4140-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4172-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4208-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4252-8376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4260-1848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4272-8834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4284-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4340-8810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4388-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4400-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4400-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4480-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4500-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4552-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4560-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4564-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4572-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4584-8081-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4588-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4612-6057-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4668-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4712-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4848-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4852-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4876-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4884-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4892-8756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/4976-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5032-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5036-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5048-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5052-8089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5056-8346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5060-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5080-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5092-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5100-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5108-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5124-5568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5128-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5180-8097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5244-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5260-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5264-8370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5272-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5344-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5376-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5380-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5444-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5492-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5524-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5544-1756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5628-8310-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5632-8714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5636-8780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5708-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5760-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5772-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5772-6854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5772-2390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5772-1850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5772-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5800-8163-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5836-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5856-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5916-8635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/5924-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6000-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6016-8822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6064-8732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6084-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                  memory/6100-8804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                  Download