Overview

overview

7

Static

static

3

4ac601d608...68.exe

windows10-2004-x64

7

4ac601d608...68.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 20:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
  • Size 6.1MB
  • Sample260922-zecnmsfa52
  • SHA256 4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4208
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4A0.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5056
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB76F.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4724
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC80.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1328
              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4624
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFAC.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4992
                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:2240
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC25C.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3572
                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:5944
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC615.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:252
                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4468
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:1140
                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:2544
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4400
                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5844
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD48C.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:5004
                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:5680
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD94F.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2660
                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3448
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:3852
                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4128
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFF6.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2552
                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1996
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE545.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2328
                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:768
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB02.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:700
                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3524
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF11D.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2968
                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4996
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5C0.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:804
                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4620
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB2F.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1304
                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5268
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3404
                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3112
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5DD.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4120
                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2796
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA33.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1408
                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5500
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3100
                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2300
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC27.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2872
                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4672
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD01.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5376
                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4936
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFB.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2644
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3104
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED6.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2804
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:6040
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA1.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4512
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4880
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a107C.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1816
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2088
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1176.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2816
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4556
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1270.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2252
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5456
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1389.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3232
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4100
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1493.bat
                                                                                                                              62⤵
                                                                                                                                PID:4980
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:1160
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a153F.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:3540
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:2960
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15FA.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:4488
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:5236
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16B6.bat
                                                                                                                                                68⤵
                                                                                                                                                  PID:4532
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                    69⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1380
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1771.bat
                                                                                                                                                      70⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:5924
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5640
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a183C.bat
                                                                                                                                                          72⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:4652
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:3008
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1917.bat
                                                                                                                                                              74⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:2152
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:2036
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19E2.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:892
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4752
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A8E.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      PID:1820
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:3248
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B4A.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:5448
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:3488
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C05.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3484
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                PID:1108
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CD0.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:3832
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:3440
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DBB.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                          PID:5860
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:5768
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E95.bat
                                                                                                                                                                                              88⤵
                                                                                                                                                                                                PID:2488
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:4092
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FCE.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4312
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:2428
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20B8.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:6108
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:236
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21D1.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:2732
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:3144
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a229D.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:6104
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:4968
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2387.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                        PID:1136
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:5328
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2491.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:4836
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a254C.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:4588
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:1744
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2627.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2721.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:4300
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a282A.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                              PID:1296
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2905.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:5956
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29D0.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5520
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:3624
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A8C.bat
                                                                                                                                                                                                                                                            114⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:4072
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B86.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                  PID:560
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:1452
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C70.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:3212
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4708
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D7A.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:5228
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E64.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:2456
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:2404
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F6E.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                        PID:5340
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:3388
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3077.bat
                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                              PID:6116
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:260
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3152.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:4788
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a322D.bat
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                        PID:2496
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                            PID:5928
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32E8.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                PID:4864
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:5232
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33C3.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34AE.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:4940
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                PID:1228
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3559.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                    PID:4576
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                        PID:6136
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3605.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                                PID:5224
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36E0.bat
                                                                                                                                                                                                                                                                                                                                                  142⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:5696
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2108
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a378C.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:1044
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3886.bat
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:5260
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4568
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3961.bat
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5804
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:5212
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A5B.bat
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:3244
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5808
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B64.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2880
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:5796
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C3F.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6012
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D0A.bat
                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1520
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3024
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E52.bat
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F1D.bat
                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        161⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4160.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a421B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a448C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4548.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3708
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4799.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4874.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a496E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CAA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D56.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ECD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F79.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5044.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a511F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5286.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5351.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5565.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5601.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5797.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5872.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a593D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B6F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F09.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FE4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6080.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a614B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6226.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a637E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6449.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a664D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6718.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6860.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68ED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C19.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E1D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F65.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7168.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7224.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a736C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7408.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7550.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7679.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7725.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a786D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a790A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7996.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CD2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DDC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EF5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a802E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8147.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  352⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      353⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8270.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          354⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            355⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a830C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              356⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                357⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8399.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    358⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      359⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5616
                                                                                                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                          PID:908
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                            PID:4188
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                              18⤵
                                                                                                                                                                                                                                                                                                                                PID:4928
                                                                                                                                                                                                                                                                                              • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                  net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:5940
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 812
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                    PID:1464
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4640 -ip 4640
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:3528

                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                      $$aAD.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aAD.bat
                                                                                                                                                                                                                                                                                                      • Size 720B
                                                                                                                                                                                                                                                                                                      • SHA256 48d761e7ebc38841c743696f2522879a529743d015645390fedfb648496cbf59
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aB4A0.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB4A0.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 2c35ba3074635dadc5fab76ad9660a1da5d22c95721e9c71bf526bdca3b08daf
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aB76F.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB76F.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 463442b602c0e35f98f42458f8203054b1b407d3edfb10fc4cb1b4739d04be62
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aBC80.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBC80.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 5cfb6a78b66e08c48f5be415e8688c655e4e41b6bd5c0706f16c12d0c02d0bcb
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aBFAC.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBFAC.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 3138a12c97947dd7faa064f6a3298ac257802efe814c13aed395df45d6e4b964
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aC25C.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC25C.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 a0380eb1db824e8ff7f0020a8996015b76ccd74ae54809789c4f57b64ea6df66
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aC615.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC615.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 d515c83917fe5d2784eb344318e07df509cfcff723b4147cd9f093be8577c4bc
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aCCAD.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aCCAD.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 0e1a01f1f20ae42664d0a62ce08651a7dae8173778ab0a91a8e53a9275398f3f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aD112.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD112.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 63004e42b49aed3408193802e31dc8a883db9f72f7624fe496dc92c32da6bc6a
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aD48C.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD48C.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 0d1e1481e48d05a71ec21268324d3658615a87bf5d3d356d336fbded2cea797a
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aD94F.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD94F.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 ed4d8fa7b5cabdff56f4c413bb507635298cb063b0bb7ef61451507c6e0ead49
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aDCE9.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aDCE9.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 754d7c82b8c0725d7c8981e6c4256d711e58cbd18eb38f260b438e9a0e028369
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aDFF6.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aDFF6.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 603cf55b8a5f7c3f852c1f3d70a8686fd77a376f09d4b258443952781799b62b
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aE545.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aE545.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 296c9b880f2284cff9cd5af5ff1065f0326d23f782956b7a493b3324df74aeab
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aEB02.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aEB02.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 febfce33deed19bba5dbc27d2a712c3f6e26a6c9d87d312ab20ff79958e881c5
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aF11D.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aF11D.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 e9c893debdc6fc746e82b3621a9e52118e4a32b005e6095172e2ba729b1faee1
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aF5C0.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aF5C0.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 49dfbd6dd779fbb8890969efe87d41a6fd76af2c8330476ccfd9e1104b3af038
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$aFB2F.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aFB2F.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 f56746b3222109c1d36e05d54f54db108fcbbcd87b996ad9d0ac6601d7ad1531
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 6.1MB
                                                                                                                                                                                                                                                                                                      • SHA256 4941628cb3e743e7dca7d48193b4bcd7aaab7f19342c33898fc968098fdbe17a
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 6.0MB
                                                                                                                                                                                                                                                                                                      • SHA256 e7fd023195997cbd3181256889158e0485e79a2c120568d72d184365e951d5ca
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 6.1MB
                                                                                                                                                                                                                                                                                                      • SHA256 2b94bac1742781708d040fa30fed965e637046392c9cf07f9c7e42a051464947
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 6.0MB
                                                                                                                                                                                                                                                                                                      • SHA256 6d7afd9cfa9d354732a726c04294d6dad4f328e81ff6a82dfdb2dd04d66756f0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 6.0MB
                                                                                                                                                                                                                                                                                                      • SHA256 b573ca07a21bb24e4acc04718f90b7c374f3f74c44e0adb3ff8905b470363a29
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                                                      • SHA256 8e76d210de01a701520c37e2fe7760bbc7698fca498cdfaa09843dafbd6be839
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.9MB
                                                                                                                                                                                                                                                                                                      • SHA256 468b50cfc743ef1da0439db0f42f8e56baf509ddc011ec467747d3129617fe55
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.9MB
                                                                                                                                                                                                                                                                                                      • SHA256 fb444c8adc2df137041a71d66f03da36cd4c9e7decc8c2bd6c5e1879b01a9c50
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                                                      • SHA256 0982b61f96c14106c1d841a3698566e769424b712ae0d3b9d9e7fc4335be0c53
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.9MB
                                                                                                                                                                                                                                                                                                      • SHA256 4b1e24bc6276afad480456559297e2e73bfd1d91c041179edde0622cc0e51587
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.9MB
                                                                                                                                                                                                                                                                                                      • SHA256 4db538270ca6dd9c101190dafec9236431829f80c79a10912a706af2a8da22f9
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                                                      • SHA256 b72fb2e6fbc6b865b94cbd1fbd42c055bf5ecd5db3a68c10432c5e4672ca804f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                                                      • SHA256 a28a49a8d285d8a15ccc8ca91be50da343118ed4f3fe2dc68f6c10b24ea2582c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 7cdbd200f866fa0ed3f48be4a381c23b86e6b13475a9b42ac1927a48410bbf66
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                                                      • SHA256 35c5f18b9e92066ccb15aeca9429fa424430812a9977e91077e75b4df7f14ade
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 996a9e222cdcfe07cf21c1cd932155c05c92f674afbdb2a206395827831c13e2
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                                                      • SHA256 7368e5f1c3a1c07ea188777f61aa70513872c9903555cf8f7d647df207a3abd7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4ac601d6087dcad1d85a9a9a59530762f21c432c814265d4e25e1fa285405e68.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 43897e96a97efbc68a9dfb893e9461b4169f754107eeb7b04bf7b41188112452
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Dll.dll
                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                                      • Size 68KB
                                                                                                                                                                                                                                                                                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Logo1_.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _desktop.ini
                                                                                                                                                                                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                      • Size 9B
                                                                                                                                                                                                                                                                                                      • SHA256 110df0648174cdd0f59f03074b074dd0856b75a6bb090739d1ea81587092e15a
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      memory/236-533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/260-619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/404-733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/612-1107-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/768-350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/776-788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/836-794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/908-369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/908-352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/908-518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1044-673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1108-507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1124-890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1152-896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1160-457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1228-649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1232-920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1380-472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1424-962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1452-593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1572-950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1624-938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1696-757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1708-1046-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1724-1058-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1744-558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1824-902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1996-342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2036-487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2080-956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2088-437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2108-667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2112-836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2192-1095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2236-884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2240-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2292-1052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2300-407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2404-608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2428-528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2536-782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2544-295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2548-1022-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2616-872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2624-739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2636-1082-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2696-1028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2744-932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2776-1131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2796-397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2808-1010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2920-926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2960-462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3008-482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3024-709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3048-1119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3060-830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3104-422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3112-392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3144-538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3152-848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3168-854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3196-1143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3248-497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3264-1137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3388-613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3440-512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3448-326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3488-502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3524-359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3556-866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3564-800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3596-1076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3624-583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3716-1088-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3760-715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4068-1064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4072-588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4080-968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4092-523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4100-452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4128-334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4176-763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4208-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4208-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4296-625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4300-568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4412-1113-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4456-1070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4460-908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4468-280-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4492-1040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4500-842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4552-998-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4556-442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4564-1101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4568-679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4604-563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4620-376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4624-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4640-282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4640-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4660-751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4672-412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4708-598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4716-1034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4724-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4752-492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4764-974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4768-1155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4808-878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4840-1149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4848-1161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4852-806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4856-553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4880-432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4892-914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4896-745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4928-643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4936-417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4956-1016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4968-543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4996-367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5000-727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5024-980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5056-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5088-776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5212-685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5224-661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5232-637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5236-467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5268-384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5328-548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5456-447-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5488-769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5500-402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5532-824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5576-1125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5620-1004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5640-477-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5680-318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5688-573-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5768-517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5796-697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5808-691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5844-306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5852-944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5892-603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5920-992-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5928-631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5944-71-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5956-578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6012-703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6020-812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6032-818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6040-427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6092-860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6096-986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6120-721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6136-655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download