Overview

overview

7

Static

static

3

69a14c259a...22.exe

windows10-2004-x64

7

69a14c259a...22.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 08:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
  • Size 5.7MB
  • Sample260924-kd18aahf67
  • SHA256 69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3639.bat
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4116
      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5388
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ADC.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4348
          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6024
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40F7.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:124
              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1036
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4452.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3160
                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5492
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a479E.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1496
                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:2080
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A8C.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5888
                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5256
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3048
                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:3764
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58A5.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:5980
                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:6132
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C6C.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2836
                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2828
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71AC.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4324
                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5844
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:6100
                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:544
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76CC.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5320
                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1984
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79D9.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6064
                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4240
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CD7.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:464
                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5100
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F96.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4608
                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5204
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83AD.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5068
                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5372
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1172
                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2820
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FE2.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5812
                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5484
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92FF.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1116
                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3064
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9531.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2616
                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2696
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1540
                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1724
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A42.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1464
                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5768
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5328
                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2880
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DAD.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1732
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2052
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EA7.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:3952
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4332
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1388
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:940
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA09B.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3236
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2184
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA166.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4852
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3324
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA251.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2340
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:6128
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA34B.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:712
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4532
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA416.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:5000
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1104
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA500.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:4300
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4760
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:1180
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:4124
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6E5.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:2932
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:4200
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7A0.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:2684
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2424
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA87B.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:1616
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:3436
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA965.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:2560
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                PID:3552
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA5F.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                    PID:3300
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1608
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB0B.bat
                                                                                                                                                                        78⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:5476
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:3856
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABE6.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:3572
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:1808
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACE0.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:5340
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:5792
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADCA.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1536
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:1408
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE86.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:1340
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5008
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF61.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB05B.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:3672
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB155.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                        PID:2816
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:4296
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:1052
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2EB.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:2744
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3B6.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                      PID:2456
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2752
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                            PID:1196
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:5964
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB53D.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:3172
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB617.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:3816
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5376
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6C3.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:3396
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:3480
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                              PID:1208
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:2460
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB83A.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:3788
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:1680
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F6.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9B1.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                            PID:3360
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:2316
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA5D.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:2500
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB19.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:6104
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3412
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBD4.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:4148
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:3220
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC80.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:2504
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:1836
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD4B.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1740
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                      PID:5596
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:5288
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                            PID:2140
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFCC.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                    PID:6112
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                      131⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:2824
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC078.bat
                                                                                                                                                                                                                                                                                                        132⤵
                                                                                                                                                                                                                                                                                                          PID:5172
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                            133⤵
                                                                                                                                                                                                                                                                                                              PID:2228
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                  PID:4456
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1C0.bat
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                          PID:2664
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:6044
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:5908
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:2660
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC327.bat
                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:3760
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                      PID:5336
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3D3.bat
                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                          PID:2688
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                              PID:3740
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4AE.bat
                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:4976
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                      PID:796
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:4884
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC625.bat
                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4436
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:3368
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6D1.bat
                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3384
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5788
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC78C.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2976
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC857.bat
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:4520
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:4604
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC903.bat
                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:1596
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5568
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9BF.bat
                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5044
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                          159⤵
                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                          PID:2220
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA8A.bat
                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:1868
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB45.bat
                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                          164⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2888
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF3D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4344
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:980
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD160.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD392.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD42E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD651.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD865.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD920.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB62.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:52
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE16D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE219.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE47A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE545.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE620.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE70B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE882.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE92D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9D9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEBBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEBB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF013.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF17A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF255.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF39D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF478.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF553.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF68B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF747.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF8AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF989.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA44.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFAE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB7D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF94.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a159.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a291.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a706.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1084
                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Creates a file in the Startup directory
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                        PID:3352
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                          PID:4360
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:2684

                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            $$a3639.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3639.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 d05152b1bdb2c86263cdbae056f5cfd6e23f50af04c39a82db3f0d7c042365cc
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a3ADC.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a3ADC.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 294bbc75daa4c69de1d8c7bc4c5e8b5338fa8a05a067c5251330fdde1b830d61
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a40F7.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a40F7.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 49d929b1cba43adb524d6dd36a44cfa02c66960d7abfe327a2bd85ec1741c667
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a4452.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4452.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 09fba94d22b62e2689626b9c0f0aa4c6684013cfe1c7c67ef13e045a29a0076d
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a479E.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a479E.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 2cc97db09fcbf951eafc8802b45d802a898a4e841ca141926a3aa86435d9ede3
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a4A8C.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a4A8C.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 b6b484c13976506f92c07f133fdbf277086a4984cdf5984676cbed427ee65914
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a50B6.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a50B6.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 6787f1955a25306585f70c23f3c96d8e3538d2797412a4c620731e95a6e992bb
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a58A5.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a58A5.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 2299e8b66b8459fbc3b8a3265ab564c6c9e606376a155766ab8bc3c11f65299b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a6C6C.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a6C6C.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 6059590e482c98cf7f004c42eaee3889f05fdd0377917e3a2a612796901720da
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a71AC.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a71AC.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 d29cce168f2635602002d0eb5e0707f9d0b05b84e50f6aef6232bc993cb2a77f
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a747A.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 b51b181bfcd036d42e34ec47993c147c81c934efd96809524db5a8c156fd999d
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a76CC.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a76CC.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 b3606dbedc230e6212bf88d642f29ef8dd70409af1165b03d28601d63d389709
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a79D9.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a79D9.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 ec48a02767dadc1d9d7904a1f855d415f2a2d3e564d5062432224ba6d5f2401b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a7CD7.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7CD7.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 1fca6dfb9e2b8329cb735289c2f299d395f450d18f6a42b67c8718cd994e6b2a
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a7F96.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a7F96.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 c6941eeb0be273a7262b472edb956696974f421f6508c28012a65cd342db1437
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a83AD.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a83AD.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 bf33865d30f594ff03a47a075c71e203cb7ba98bcd4a6af957a15a6d59583183
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a8D23.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 324dbb87ea6e31c674e9cb02d1da57e6af06016b1c5689a04b212cd0f1a61a89
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a8FE2.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a8FE2.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 4a3f0887cab054566666d8ff40dd7bce2e40c5f2181ed2bc747b988c034286a0
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a92FF.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a92FF.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 15118dfdde2367683cdcdb9ba9c95edae08ff2098ab919a669309ba1b488261d
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a9531.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a9531.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 2e09689a5c2bfe8e5d14ac9875cd859594ea3935a8d9b375586bd6119f6de145
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            $$a97F1.bat
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                                                                                                                                                                                            • Size 722B
                                                                                                                                                                                                                                                            • SHA256 5d94aefd7ecd8b87f43b1c81b5a296e799d40ef67f76eea6790102c1c0532dca
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                                            • SHA256 2e9e7457b9926b1f9d1849beb0dcb4d4a7429a5e723b61591d817b685ecfb14d
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                                            • SHA256 ac0f5a19694d4df5cdedaec21043fdf9a39f8b7237e6cf64c89bf6d848f40e49
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                                            • SHA256 0a69f28e6b1c750d7247916885bca9b4efd749fb52ef31894199e62b484dce84
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                                            • SHA256 5bdaa826bba7725d1e06672d5086fb8007245ddb53f597864bafff6cd677ac40
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                                            • SHA256 4c0e0029142416c83bebf13edc67f39927624f65128d8b94f40584dca9e22358
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.3MB
                                                                                                                                                                                                                                                            • SHA256 89a1ab4ec5618625508c5485cc83d3a9784ddd041696006ec135948417c1c469
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                                            • SHA256 bef8a1e9b4c3bb426d66f46b2014e29f9425d97651f6b6f2c6c2de991537e4c1
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.2MB
                                                                                                                                                                                                                                                            • SHA256 61f3036b3337023759ef580df8a3342894606a55b37450d2caf0acf0cbef2d12
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                                            • SHA256 ff26bd5c22af0da989817042763825801e506d046b1c829ba69b9823c659ff58
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                                            • SHA256 30d490b7005acce375f7f5277c7a64cc3872dcc275439642cd3c0268e260cad3
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.0MB
                                                                                                                                                                                                                                                            • SHA256 cc3a209347a135a1bdeb4503723002e6f3999618c848c96e5d78276ab60b3076
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.1MB
                                                                                                                                                                                                                                                            • SHA256 41ca2f0378e9d972f4daf76f58c692aec6c0a04e5355eeacb158230fb9186cc3
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                                            • SHA256 d351a2fd42325bd6f1bf74798397f515a87e861029c940f513943ff7fee229eb
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                                            • SHA256 57130d7b120194cb0829d9abc387e72b5e72203ba66f00cdff9cf31013d1082a
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.7MB
                                                                                                                                                                                                                                                            • SHA256 8764010cf976f391616bfd925dabcd736c7c81f5d7e418c81d9af781d1d46a67
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                            • SHA256 eb7ecfcf935f5c0e0c162003c1e64ee559e6c56944d7097065dc514abc3e4e17
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                            • SHA256 baa1ae1d44c1237e1d46adb85f8513cfe49b4708872ca36cbb36a158bed0776d
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.6MB
                                                                                                                                                                                                                                                            • SHA256 077561f229d89f272cd433656c825d56ffc3e64d05fdb4849d40101d4c55ac9d
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.5MB
                                                                                                                                                                                                                                                            • SHA256 c3cc84ec77e53a8e426c4e99d82211186eb91a34818f034f82be327a736afe3b
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\69a14c259aa20e348c06096ed61bb8cbbc43af815a5af77dfea757e1db92f122.exe.exe
                                                                                                                                                                                                                                                            • Size 5.4MB
                                                                                                                                                                                                                                                            • SHA256 539106f1a98ab3ce6832d181ca37ab7dbb19111026990426607d568efa932fc7
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            Logo1_.exe
                                                                                                                                                                                                                                                            • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                            • Size 32KB
                                                                                                                                                                                                                                                            • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            _desktop.ini
                                                                                                                                                                                                                                                            • Path F:\$RECYCLE.BIN\S-1-5-21-4057491610-3392471755-192832105-1000\_desktop.ini
                                                                                                                                                                                                                                                            • Size 9B
                                                                                                                                                                                                                                                            • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                            memory/544-5754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/940-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1036-51-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1052-8380-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1104-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1160-8912-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1232-8894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1296-8991-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1328-8936-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1380-8973-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1408-8355-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1412-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1468-8750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1516-8949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1592-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1608-8333-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1636-8732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1656-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1680-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1724-8248-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1740-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1808-8345-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1836-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/1984-6044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2044-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2052-8263-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2080-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2088-8985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2116-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2184-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2204-8648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2220-8557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2228-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2232-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2316-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2372-8858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2424-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2448-8804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2460-8415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2592-8828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2640-8708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2660-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2696-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2740-8798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2744-8385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2752-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2772-8810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2820-8216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2824-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2828-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2856-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2880-8258-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/2888-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3036-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3064-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3092-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3220-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3240-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3292-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3308-8882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3324-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3352-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3352-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3352-986-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3352-2482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3352-6866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3356-8924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3368-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3412-8440-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3420-8930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3428-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3436-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3448-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3480-8410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3488-8816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3552-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3672-8370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3740-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3764-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3856-8339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/3864-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4100-8666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4124-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4164-8539-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4200-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4228-8822-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4240-6052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4268-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4284-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4296-8375-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4332-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4344-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4356-8780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4408-8738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4444-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4448-8435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4464-8852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4496-8714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4504-8864-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4516-8943-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4532-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4540-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4596-8979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4604-8545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4612-8888-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4632-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4740-8726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4760-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4784-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4804-8870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4812-8900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4864-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4884-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4888-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4888-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/4900-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5008-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5100-6064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5204-6178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5256-501-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5276-8906-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5288-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5308-8961-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5336-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5368-8756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5372-8208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5376-8405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5380-8918-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5388-22-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5448-8792-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5484-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5488-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5492-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5560-8840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5568-8551-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5600-8967-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5608-8400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5664-8955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5684-8786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5712-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5724-8876-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5768-8253-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5772-8696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5780-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5784-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5788-8533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5792-8350-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5844-5567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5868-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5876-8997-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5936-9003-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5944-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/5964-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6008-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6016-8834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6024-39-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6032-8846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6044-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6128-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download

                                                                                                                                                                                                                                                            memory/6132-5172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                            Download