Overview

overview

8

Static

static

3

074e1e055d...9e.exe

windows10-2004-x64

8

074e1e055d...9e.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 07:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
  • Size 5.5MB
  • Sample260924-jb265agh24
  • SHA256 074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a259F.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29F4.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1404
          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:5484
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DBD.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5976
              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2896
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a305D.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:5372
                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:2984
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33E7.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:268
                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3432
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36D5.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1648
                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2844
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A6F.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2520
                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:1432
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a453D.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:460
                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:1156
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4731.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4496
                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:2932
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C90.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4712
                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4620
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D0A.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4124
                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:4984
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EDF.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:236
                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1124
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6538.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3628
                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:108
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4864
                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5992
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A78.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4640
                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5644
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EBE.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1812
                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3820
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7814.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1116
                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5096
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AD3.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1780
                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5808
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D16.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:3176
                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5924
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8013.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2360
                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1204
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a836F.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5464
                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2372
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84D6.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4324
                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4308
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85B1.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5284
                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4656
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86CA.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5068
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3412
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87A5.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4944
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5316
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a889F.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2496
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2836
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8999.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4560
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3740
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A83.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1792
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1472
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B7D.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1316
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5612
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C67.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5380
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4808
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
                                                                                                                              62⤵
                                                                                                                                PID:2036
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3184
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E4C.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:5640
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2608
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F46.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:5376
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:4572
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9030.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:2336
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4384
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a911B.bat
                                                                                                                                                  70⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:5192
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3148
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9205.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                      PID:1660
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:2308
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930F.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:5848
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4368
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F9.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:848
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1012
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94D4.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5516
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:2432
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95DD.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:1736
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:2708
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a96A8.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                              PID:5008
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:3644
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97C2.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:1708
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5100
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98BC.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                        PID:3036
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:1852
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99E5.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                              PID:1300
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:4188
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ADF.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:5292
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BE8.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                        PID:2492
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:2104
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CD3.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4776
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DEC.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:2884
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:5840
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EB7.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                        PID:924
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4156
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:3392
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:2128
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:952
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA176.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:4896
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA260.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                            PID:300
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:5676
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:1816
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:4872
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA464.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2688
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3000
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA54E.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                          PID:4448
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:3016
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA639.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:1632
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:3208
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA742.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4332
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                        PID:6108
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8D9.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:2252
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:5488
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9C3.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:2056
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAAD.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                        PID:2352
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          PID:4600
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB98.bat
                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:2328
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                              127⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:1088
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC82.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                      PID:1100
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                          PID:1880
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                            PID:2076
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE67.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:916
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:1596
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF80.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                    PID:5280
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:3444
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB155.bat
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:4344
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                            PID:2848
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB22F.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2EB.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:4512
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                        PID:5764
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B6.bat
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                            PID:4300
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                                                PID:3736
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB491.bat
                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2856
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:5116
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB54C.bat
                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6020
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:3580
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5E8.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4680
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6A4.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1584
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:2604
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB75F.bat
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5172
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                              153⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB83A.bat
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:3064
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB905.bat
                                                                                                                                                                                                                                                                                                                                                                                      156⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3804
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9A2.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:252
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:1620
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC41.bat
                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2796
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3140
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0B6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC22D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC588.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC663.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC72E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC819.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC980.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD046.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD19E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD24A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD315.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD48C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD577.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD642.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD855.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD901.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD99D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD27.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE015.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE18C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE229.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE342.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE4D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE565.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE611.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE759.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE99B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA37.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aECD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED83.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF77.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF013.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF255.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Creates a file in the Startup directory
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:4512

                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                              $$a259F.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a259F.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 d643c6d190a94f66b522c9691dbeb3f96804407bb2e894c7d9586a268352332c
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a29F4.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a29F4.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 7bdf00ea5652732156e7e430808fcab2ce574b682f4dec29525df67966871b6f
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a2DBD.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2DBD.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 136eafba5e3521a267e55ddc2d3fadaff0465f9fabc290febbfe2e81bda568fe
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a305D.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a305D.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 b1289b5e680d89e422faba88a22e527f41e08ff9f62b700fcd9661e6171e49a2
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a33E7.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a33E7.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 e484964ba98f75d9725edce8e0d2e3551f86c37f2e5cecf8f5494712238f3a42
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a36D5.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a36D5.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 275076332b0b7d3c48681d3e9b7708e0cc6b148eb89e48a08d9dcc0010ae0ad9
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a3A6F.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a3A6F.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 8504b7594d8fcb14ceae94cfc2a280d653e23b560fee6b85295972217fca4af5
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a453D.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a453D.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 a4c24c2c899c603b96896bc2603e9ea90838aa55038775f28afd08282b0a1bd0
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a4731.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4731.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 839047ace48f7eaab708fceb542acc68aef92751ed8a85a830e669381605baaf
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a4C90.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4C90.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 eb9ff89656fa1094e9a5f2210025ee0e9c6d2b2f9a4823c35f37b0246d4cc0c4
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a5D0A.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5D0A.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 8e2e7851b9b3872e25ac66b8308b07f91b02ab4ddb9576d94c8e1558e3879c9a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a5EDF.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5EDF.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 2fe100c487b6365fc7bd72bcef61de149b8cafea59510762dc1d8b7fe592e680
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a6538.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6538.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 9380b13c6baa0981c5965f5031425f671b883200b671aceff00ba406dbf86979
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a679A.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 a01a31119708a421f5569723bd95579cca476a2dab99875e8bab7f94567cb331
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a6A78.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6A78.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 75baf221f989d20d2543b1d9678047bc3f1779d40f46e31b3bd41f784c03f82e
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a6EBE.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6EBE.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 00c720cc51d4061629259c3250b10d1312b9260cd49f2c607f44d5d8a0791135
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a7814.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7814.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 65db8c5db01a278313302aff13c815bc06f4161700524817310266695b0b7990
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a7AD3.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7AD3.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 887b3d96ba667946376b13b624dbeb5ef265f9a5c716c706c80c847e8f3f9a08
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a7D16.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a7D16.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 cbe0c07ce80726b26e1f5548e3e06852e95cf12105cc5b6bdb7767a380350b1a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a8013.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a8013.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 8b3173f8dc0dd0364208dc097e7ccf62ba5731fcd0338e19ef3396e7b1ff8c4c
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              $$a836F.bat
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a836F.bat
                                                                                                                                                                                                                                              • Size 722B
                                                                                                                                                                                                                                              • SHA256 5f3e2d470229bbf026af54675834d1419d0e7907dd8369e3b85e92e0ceed5c13
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                              • SHA256 f6501c879f637e9f284df8b334a6b27ffdbdc65ab6ba5607af77c2dc61fdbd1a
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.1MB
                                                                                                                                                                                                                                              • SHA256 6f74cd53c4e97407376c9a0ada842b4186c9d4eb85d483a62c09b4ab287d1e37
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                              • SHA256 008327474ffd2a94ccdcfff9692e45abd8bf61cd58083998feb800a8feb17c93
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                              • SHA256 53d23190602966a545bea7deb44763e8b2c68dc5f6710f15d25a733d1e7139da
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 4.9MB
                                                                                                                                                                                                                                              • SHA256 92a0e053d7e2c3e0186f36811d1aaea3430303d00f6ff10c92af87e1621c38a9
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                              • SHA256 dafc792aea730ed19c13c4f79369b6282443370cef0855d829e55b5632b9fffe
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                              • SHA256 2213f8010b8c4ae5d5cf4521ea19f2fb4ceca7c75d49484a44c08a1d075e6365
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 4.9MB
                                                                                                                                                                                                                                              • SHA256 d1734a6ea540b3401373746f557b3ea62bff7c4ffa11bb3116762af428586f02
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 4.9MB
                                                                                                                                                                                                                                              • SHA256 4484f4d6761d46d2600272140d8132ecb3eb5f716cf5503050943fec0a0a3d74
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                              • SHA256 37698804c059af5cd97bcb138e3e23749a0a3c7597db8479035904bbdebd9c82
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.1MB
                                                                                                                                                                                                                                              • SHA256 ada5629f3e2576d7d686c70d669765daaf068983819b3b066ebff262e7865409
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 4.8MB
                                                                                                                                                                                                                                              • SHA256 3ba597c9f03584dab0cf85a4003035eb7c970239fcc750525b140a6d61cf5233
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                              • SHA256 450555cb6d0461e470be07e8eca875802d2f194ef5608829f6515dfccd20dfe6
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.2MB
                                                                                                                                                                                                                                              • SHA256 ef73ea859af0bcd136a2ce8611fbfe13d8978ab11508f449e49e678f055f5ae2
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.1MB
                                                                                                                                                                                                                                              • SHA256 9809fd356758340b58ea94afc6ac8e43bf0956a358ba59cc0580da92733674b0
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.0MB
                                                                                                                                                                                                                                              • SHA256 c746d2d575a08b312d27c7491e989e50c681599ea14bb0de3db8973dc4fe3fa1
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.4MB
                                                                                                                                                                                                                                              • SHA256 4cd3d01fdfb03aef166146d971bd93ca85983572ed6e2b61af25abf108b37fbf
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.3MB
                                                                                                                                                                                                                                              • SHA256 3f88e881fc587ce0636a21176c69130bc13f72483781b61c3884b0ce49917d11
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.2MB
                                                                                                                                                                                                                                              • SHA256 93f2bffbe3c7722fbb87510e70aedae189eb32fe39b0201fd34b4cf996dc7f03
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\074e1e055d1c744f0fa95384d11f4a64517cb061077341e632d3276e5c23169e.exe.exe
                                                                                                                                                                                                                                              • Size 5.2MB
                                                                                                                                                                                                                                              • SHA256 e69d18f3b60dc5c4b35f8fba262bad5e8100d99bbeae71bc2010caf167e08461
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              Logo1_.exe
                                                                                                                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              _desktop.ini
                                                                                                                                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-2714045687-1127350534-2056456672-1000\_desktop.ini
                                                                                                                                                                                                                                              • Size 9B
                                                                                                                                                                                                                                              • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                              memory/108-6053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/404-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/476-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/620-8948-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/692-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/952-8374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1012-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1076-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1088-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1100-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1124-6045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1156-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1200-8568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1204-8217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1264-8791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1340-8779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1376-8954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1408-8833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1432-1840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1472-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1480-8409-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1596-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1612-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1620-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1820-8731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1852-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1924-8737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/1932-8379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2056-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2060-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2060-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2064-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2072-8797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2076-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2088-8930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2104-8349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2124-8755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2128-8369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2264-8887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2308-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2372-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2388-8815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2432-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2536-8809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2604-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2608-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2652-8827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2656-8743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2708-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2792-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2796-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2820-8719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2832-8803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2836-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2844-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2848-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2876-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2880-8586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2896-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2932-2445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2976-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2984-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/2984-3616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3000-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3016-8399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3032-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3052-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3056-8918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3116-8966-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3140-8574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3148-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3184-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3208-8404-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3236-8875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3404-8869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3408-8960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3412-8238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3432-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3444-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3448-8924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3452-8905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3456-8635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3580-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3644-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3696-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3736-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3740-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3820-8183-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3876-8968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/3952-8344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4112-2553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4112-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4112-7668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4112-1844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4112-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4156-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4188-8338-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4256-8520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4268-8514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4276-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4308-8228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4368-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4384-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4440-8839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4536-8707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4568-8725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4572-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4600-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4616-8701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4620-5568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4656-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4664-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4680-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4708-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4768-8641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4776-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4780-8538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4808-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4836-8767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4856-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4872-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4892-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4920-8713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4928-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4984-5576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4992-8881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/4996-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5096-8191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5100-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5116-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5144-8863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5316-8243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5392-8893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5408-8911-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5412-8942-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5420-8562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5456-8761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5484-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5488-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5504-8785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5528-8936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5612-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5644-6295-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5652-8773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5676-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5724-8526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5764-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5788-8851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5808-8201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5824-8899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5840-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5884-8845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5924-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5988-8749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5992-6065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/5996-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/6060-8857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/6072-8659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/6104-8580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                              memory/6120-8821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                              Download