Overview

overview

7

Static

static

3

8a5fb4b11d...c0.exe

windows10-2004-x64

7

8a5fb4b11d...c0.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 08:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
  • Size 5.5MB
  • Sample260922-j4467abe92
  • SHA256 8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36A6.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4456
      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6044
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3946.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5280
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D4D.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2336
              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4416
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2148
                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1596
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4349.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:296
                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1708
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a455C.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2432
                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3608
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48C7.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3400
                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:4152
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BC5.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4828
                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1012
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50D5.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2976
                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:504
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5700.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:5328
                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:1252
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5922.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:5220
                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:2128
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DA7.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2752
                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5584
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FCA.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5320
                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5708
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62B8.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5456
                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2068
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6567.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5960
                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5488
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67B9.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5508
                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4680
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A0B.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1568
                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5416
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CCA.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1712
                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2108
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F89.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2804
                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1848
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a719C.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4932
                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4560
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7296.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5504
                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3852
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7371.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2020
                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2908
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a745B.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4288
                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2828
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7546.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4748
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3952
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7630.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4600
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2656
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a771A.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4208
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1256
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7872.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5244
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5652
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a797C.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4448
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1096
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A66.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2588
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4952
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B41.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:4588
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4500
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C0C.bat
                                                                                                                              62⤵
                                                                                                                                PID:3008
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:5668
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CD7.bat
                                                                                                                                    64⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4376
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:2300
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DE1.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:4648
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:704
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7ECB.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:2788
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5016
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FA6.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3568
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    PID:3028
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8090.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:4920
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4108
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a816B.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4196
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3484
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8255.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:1880
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:3372
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8311.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:1356
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                      PID:4344
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a840B.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:1240
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4528
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84D6.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                              PID:5676
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4172
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85B1.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:5452
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4488
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a867C.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:2812
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:4968
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8766.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4100
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:1520
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8851.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:4868
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a890C.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:1440
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:1748
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D7.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4872
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8AB2.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:712
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4820
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B9C.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:5460
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C67.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                          PID:3904
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:5316
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:5332
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DDE.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                    PID:2396
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:2840
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EC9.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                          PID:3700
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F75.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:1072
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9040.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:3784
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a913A.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                        PID:2144
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:1228
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9224.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:716
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:5404
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930F.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:3944
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:6052
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93CA.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3456
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:3508
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9495.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:4780
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                              PID:696
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                123⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a961C.bat
                                                                                                                                                                                                                                                                                  124⤵
                                                                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:1540
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96F7.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                          PID:1832
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:1860
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D1.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                PID:6020
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:2532
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a989C.bat
                                                                                                                                                                                                                                                                                                    130⤵
                                                                                                                                                                                                                                                                                                      PID:1528
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                          PID:2928
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9996.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                              PID:436
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:3536
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A81.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:4812
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                            PID:5412
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C36.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2368
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CF2.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:2168
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                        PID:4436
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DCD.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                            PID:1308
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:5388
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EA7.bat
                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:3016
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F82.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4556
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1196
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA02E.bat
                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2412
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5748
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA109.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:3488
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:4300
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1B5.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:3968
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          PID:2728
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:5500
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2868
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:2880
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1052
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA454.bat
                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        PID:4636
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:1772
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA520.bat
                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3056
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3252
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1788
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA677.bat
                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA88B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA936.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:672
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:352
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3572
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADAB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB01C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB200.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB28D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB31A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3D5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB53D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB898.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB915.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBADA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC80.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFEB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC087.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC104.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC191.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC21D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC366.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC52B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC654.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC76D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC876.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC913.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC99F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA4B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAC8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD018.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD095.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD24A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD354.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD45D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4324
                                                                                                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                            28⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                            PID:2704
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                              PID:252
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                30⤵
                                                                                                                                                                                                                                                                                  PID:3416
                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                            PID:2376
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:3700
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 980
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4964 -ip 4964
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:1232

                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                $$a36A6.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a36A6.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 190be84dc2c29a5277739e382eb3492c3309eb41b5b23a5e765ce5e23670f5a6
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a3946.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3946.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 83e0a305181427e8e7f18b3d8ed00e5801f1719be7c4cf233a44b3f6be79c940
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a3D4D.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a3D4D.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 c62c7541d512cf6c38272aba69db11c929f16bd4bf01e1b19f74d5b2f3a47e5e
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a406A.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 795c587b1624dd3b51ed938784a74b18c4f74d62298e9314ec043e9233ed9c0a
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a4349.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4349.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 56af81a9ba1a4e41b18138f178385144c14d1f419705a52d65c7e83eb3a24417
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a455C.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a455C.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 d689cd4cae3461c48b89fda6cdae09b850e0f48ad8c9c7be4851431930644e0f
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a48C7.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a48C7.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 bb6c30f363069a4ec5b8a0e3636b8bb54e71e5a573d1c95dc83c54401ef21d1b
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a4BC5.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4BC5.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 7d29c680d9260c88441c55cba20650eff5150d0d6c26fae46bf90f5ced9ebe64
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a50D5.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a50D5.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 85efe144c2967ad762f6d83d8bed571d1b14aabd70c6056797ea936913a7b868
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a5700.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5700.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 7c27389ec908c899b0f315075c2cb8fa7eda03007b4b2dec8c18357376053d88
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a5922.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5922.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 4515f5b2b517fbd4e64bf945f961154c106aad3771019451766b95d7ead29114
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a5DA7.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5DA7.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 917164b48ed940d8f73c785a140f11fbbf12e0b939a17df8533fb85aca385968
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a5FCA.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a5FCA.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 4cd589a9197c50bbd965a1dee36fc2375ad59d94f33ecf9f09bf1331dd2b288f
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a62B8.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a62B8.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 94b2fe4703ad305a20f9b3cbd972b5c0c3093d3dfb2f94535c473e7728462b2c
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a6567.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6567.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 58d7b072bdd755bb41fdd0b226d22f1c3d95f6e7735904ddf7aeeca1d3700428
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a67B9.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a67B9.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 ddfd0a81fe0ff483a1d4c68b4345502dc8fba7d4b839635308dc80047a5337bb
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a6A0B.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6A0B.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 52bf5fb5efb85ff240c00c0b7a0bde9ab9265be43b532242cce6fdd95ef003b6
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                $$a6CCA.bat
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6CCA.bat
                                                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                                                • SHA256 4c7dd15ba8a6459a3af805153d7b9a2ff963b823dca64f5dccc950c7b881c87e
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                • SHA256 4cd1bbf0457550fc5448c8ca3c01fd3e30101f4971882d531260daa320912aaa
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                                • SHA256 3bb8ac91c49c811375c10c1f64404ed6231cec9b04384472192644216de0d4cf
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                                • SHA256 d72bb743629516af1612a0067604b7e3535b02eca882693032e7b686d1c2c173
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                                • SHA256 dfc6702e4e0db388b0bb1aed35bd58365105fcee3e01c72d5fb4af51da3f1c93
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                • SHA256 73c5628ea7e9e13ca312178d2b4b60c79e29ff9906c38c57f54b62c3087e8967
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                                • SHA256 76ea521211ba0e25dafc2f0f8aaeff024394e717579a882ad1ab75e79739434d
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                                                • SHA256 3b4bdaf9698633896c0cdb90beaba5e4ad090ee1e7ce92931e08d714df303b41
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                                                • SHA256 616e417526d20f8339202a6ab6778d8751bcf0d2a78f08bcfb04c0deebf726ab
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                                • SHA256 97607a34176f9d1477112132a3b4b1025830dc40053ea0f2d8be4e73a3fbc477
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.5MB
                                                                                                                                                                                                                                • SHA256 1be20bae995036a51d91f00b73f97610a46102637dfb5b926be31884080ddbcd
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                • SHA256 b13679afbd6a0b6e072dbcf32616890539ca66024d6eb231edff75a1dc27e057
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                • SHA256 1ba2585f941caad8028832f53ae1d18716b87b02f9b7c07f4c879be1ef261be9
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                                                • SHA256 6dbc8dd0a91a4bc0badc8e12d126e8be5aa3f64fe33049f973b8705081e78edf
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                                                • SHA256 6cb49f095f887764877a9b5c838e9677ffd9e194c40a63098fbf45cb4b69bb4e
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.4MB
                                                                                                                                                                                                                                • SHA256 0f25819ee1b04a8f940861cda0e7614c3d5ffcf43c6500531674709d6368a895
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                • SHA256 72a9201b67dacbc0d6c71ee2be6ba0d25a17173eedbacaf41d9fde07375e0b7a
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                • SHA256 a9151bef749ce6b8f2c67972d12afaef4ac0923a55224ca57768140f01256cb7
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8a5fb4b11d0188a23cd599409a7e979acc0babecd66d80caf556113a8e29ffc0.exe.exe
                                                                                                                                                                                                                                • Size 5.3MB
                                                                                                                                                                                                                                • SHA256 8e9c33d9065db04d9f2d5d1b844143889f25449a727bee24b16b10d07ee42656
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                Dll.dll
                                                                                                                                                                                                                                • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                • Size 68KB
                                                                                                                                                                                                                                • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-4057491610-3392471755-192832105-1000\_desktop.ini
                                                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                                                • SHA256 110df0648174cdd0f59f03074b074dd0856b75a6bb090739d1ea81587092e15a
                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                memory/504-1858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/672-2309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/704-2023-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/824-2388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/848-2688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/936-2622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/956-2616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/992-2496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1012-484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1052-2261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1072-2129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1092-2369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1096-1998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1196-2231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1224-2159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1228-2139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1232-2628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1244-2345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1252-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1256-1988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1348-2424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1520-2078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1540-2169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1584-2514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1596-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1604-2448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1612-2363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1616-2694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1708-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1748-2088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1772-2267-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1788-2279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1848-1952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1860-2175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1872-2436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/1932-2412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2016-2357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2036-2634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2068-1911-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2108-1947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2112-2382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2128-1876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2208-2670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2220-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2224-2532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2300-2018-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2364-2114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2368-2211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2532-2181-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2656-1983-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2668-2574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2704-2089-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2704-1968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2708-2466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2728-2249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2824-2586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2828-1973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2840-2119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2856-2333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2868-2255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2908-1967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2928-2187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2932-2664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/2992-2700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3028-2033-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3136-2556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3148-2339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3168-2291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3252-2273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3276-2652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3280-2394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3304-2604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3372-2048-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3412-2502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3416-2526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3428-2598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3484-2043-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3508-2154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3512-2315-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3536-2193-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3572-2327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3608-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3764-2520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3784-2134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3788-2706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3808-2646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3852-1962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3864-2442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3924-2682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3952-1978-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/3984-2484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4108-2038-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4136-2676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4148-2285-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4152-110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4172-2063-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4232-2460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4248-2430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4272-2580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4300-2243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4344-2053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4388-2562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4416-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4436-2213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4444-2164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4488-2068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4492-2508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4496-2225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4500-2008-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4528-2058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4560-1957-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4680-1931-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4800-2104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4820-2099-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4844-2550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4856-2199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4868-2083-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4872-2094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4924-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4924-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4936-2490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4952-2003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4964-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4964-399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4964-1880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4964-1886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/4968-2073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5004-2297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5016-2028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5104-2478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5116-2472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5172-2640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5280-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5296-2568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5316-2109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5336-2400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5340-2351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5388-2219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5404-2144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5412-2205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5416-1939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5484-2124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5488-1921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5492-2418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5584-1885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5628-2454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5652-1993-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5668-2013-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5708-1900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5712-2321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5748-2237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5828-2376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5836-2406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5924-2592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5928-2303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5936-2658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5972-2544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/5984-2538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/6044-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                memory/6052-2149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                Download