Overview

overview

7

Static

static

3

7a55f076aa...44.exe

windows10-2004-x64

7

7a55f076aa...44.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 06:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
  • Size 4.6MB
  • Sample260925-hdvdmasbkh
  • SHA256 7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3CD.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1856
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5D0.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3832
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8ED.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1292
              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:1008
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD14.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1432
                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5700
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF65.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4296
                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5784
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1E6.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3504
                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1352
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB438.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2916
                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:1468
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB764.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5168
                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5748
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCB4.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:6124
                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:1056
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC464.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3956
                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4644
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4F1.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4652
                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:6056
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAEC.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5664
                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2420
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE38.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2724
                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1716
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD193.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3136
                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5488
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4B0.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5228
                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4884
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD78F.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4916
                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1180
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA3E.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1604
                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:6024
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1288
                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2512
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE318.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4912
                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3296
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE54A.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2244
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:6108
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE877.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4552
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5680
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDE5.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2264
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3936
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEDF.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1188
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4360
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0E3.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4112
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:316
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF1DD.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4772
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2204
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF2A8.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3480
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:6032
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF529.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3372
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1712
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5A6.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4312
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3608
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF652.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:4324
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4300
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6FD.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4332
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3680
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF7A9.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1556
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5164
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF874.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:908
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:1624
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF901.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:3336
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3220
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF97E.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5140
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:5676
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA1A.bat
                                                                                                                                                70⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4212
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:3280
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA97.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:4844
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:656
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB24.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:6120
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3516
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBDF.bat
                                                                                                                                                              76⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:5016
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4488
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE02.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:624
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2440
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF2B.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4496
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                        81⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:1692
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44.bat
                                                                                                                                                                          82⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:1840
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                            83⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:4288
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15E.bat
                                                                                                                                                                              84⤵
                                                                                                                                                                                PID:4204
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:740
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a258.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4816
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:4540
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:5760
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:6020
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DC.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:1652
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:4780
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a824.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3036
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91E.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                        PID:5432
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:1908
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA18.bat
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:5152
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB12.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                  PID:432
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC89.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:5376
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:2448
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAC.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                            PID:2800
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:5880
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA6.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                PID:4776
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:5576
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1090.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1124
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a111D.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:3808
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11D8.bat
                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:1364
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1275.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                    PID:5724
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12E2.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:3216
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4148
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a135F.bat
                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:2436
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                              117⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13EC.bat
                                                                                                                                                                                                                                                                118⤵
                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                  119⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:1544
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14D6.bat
                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                      PID:1816
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:5116
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1553.bat
                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5148
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1456
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15D0.bat
                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:4028
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a164D.bat
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:392
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16E9.bat
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:5836
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:2516
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1766.bat
                                                                                                                                                                                                                                                                                          130⤵
                                                                                                                                                                                                                                                                                            PID:716
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:3344
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1803.bat
                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:3796
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                    PID:5100
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a189F.bat
                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                          PID:2432
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a191C.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:896
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:1516
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19B8.bat
                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:1148
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4016
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AB2.bat
                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                      PID:2240
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        PID:4052
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B4E.bat
                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:3016
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:5320
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BDB.bat
                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:5764
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                  PID:6040
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D42.bat
                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                        PID:4252
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DCF.bat
                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                            PID:5136
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E5C.bat
                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:1300
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EF8.bat
                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:5048
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:880
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FA4.bat
                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:3408
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2011.bat
                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              PID:5440
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:6068
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a209E.bat
                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  PID:6072
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2508
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a210B.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:5820
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:2592
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2198.bat
                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              PID:5980
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2234.bat
                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22A1.bat
                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:2820
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3284
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a233E.bat
                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:2304
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:1092
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1472
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2447.bat
                                                                                                                                                                                                                                                                                                                                                                                                      172⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          173⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2570.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2689.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2424
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2706.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2793.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a286E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2968.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A23.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B2D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C85.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D11.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F53.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FFF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30CA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3118.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3176.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3212.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3280.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a333B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3474.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a353F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3658.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3723.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a386B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3917.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:60
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A40.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ACD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CF0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F90.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a404B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4184.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2132
                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                  PID:1220
                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                    3⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:3848
                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:6132

                                                                                                                                                Network

                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      $$aA3CD.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA3CD.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 db46b9a201a0c91516c4f8beaeca74798912d1a157ce6fa38109ead68096af3b
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aA5D0.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA5D0.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 c94b196e4be8560fbf492822b34490cb00c7238d1a7b61de8fef7c894ef7aea8
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aA8ED.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aA8ED.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 529cdb040db762d38ad5215158a56fc6821c981f860964c4cd429a2fc7b3c1ef
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aAD14.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aAD14.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 56a81a8526ffad69cac088161d3aa52ba9c08e46c80fbc644f975f99b6f61d09
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aAF65.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aAF65.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 16aa090aa878249bc6a3cfcf17a0797483e54d41e7e51ba485bdd4293a8a1c93
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aB1E6.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB1E6.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 5a2607e2dd89c6b0a0e842bf285cbe0c4c62a18e82a128ae5fd5ad0a78a3a9a3
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aB438.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB438.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 358969fb06dbe5649678b563cdb85b766889c3a3266b4e74b96054b1993aa8d9
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aB764.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aB764.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 a151ca6761e42d7374049272f09d46c87370c8b72942776dd53ec9b3a92b8dcc
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aBCB4.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aBCB4.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 09213f36d98476bd22566b6ee0a81f2cf43bff6a444af7d3ff77ca9803ed1ba8
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aC464.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC464.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 4a8129e542300ee660d8240c4a905a6e09c5bccd4e3c9dfbe1886432d0773400
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aC4F1.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC4F1.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 e0643b6ed1d2db7e77e2be98cdef02601986af563b5d9d080aa510def9f4e93a
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aCAEC.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aCAEC.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 9a517461a96716192ba135ef71b1436d7994ddce7cf389a7b1362657b08ca0ad
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aCE38.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aCE38.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 f184ca5b25b6636c472b3212f91a0ad1fba927fdd1cbe184cd348e01f3fa59dc
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aD193.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD193.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 84d0178a983b9065ff36873480d9d77d2d27eb895ef5c296527a3033123f725a
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aD4B0.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD4B0.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 3744dacff6a5df0f0d97db0e8cb93817538651ede2ff6366c0d9c6eb5437cf15
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aD78F.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aD78F.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 b8cc571eb61228d938af40fad46a44553a3db5471f4b5660477425390d626290
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aDA3E.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aDA3E.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 5aa341eabcfe80520d9ab4a701773b2b0555199c5fb5444dbd0640501d581a4e
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aDD2C.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aDD2C.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 32382a919e58392a99d0139bf82d2802261e567ad6740d3cbe0c34a0704b63cb
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aE318.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aE318.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 5c324921b09880ae2dc9f984f304d64de4f5cacf229bb62c19e29be27031e8e1
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aE54A.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aE54A.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 68641586d5067181cc412633942e4616e015c5afed9f57c128703ff27b4593a2
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      $$aE877.bat
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aE877.bat
                                                                                                                                                      • Size 722B
                                                                                                                                                      • SHA256 2ed4c3c9ca247812aefab224488139a1c654328b0b754270c9d93fb28d57b661
                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.5MB
                                                                                                                                                      • SHA256 baeda72c0d6b22d3d9c62801d7730fa8e935efc4d4ca48e45bc83876be3bddcf
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 fcfcb85e8416087a6e4179dec31516855c53daf0a664ad79ab7ba890ef435321
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 3126ab17077daa89a80b3d69e11415c2d012074d695721b928417b254a647648
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 b53136367a1fa5242fa2b1181bd96f8e814412fba819e34965f763dcad5c3ffc
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 21c9b9e46e555f501f5858a78b576be0c488db930b3ce71dc59821fb6c1fa5c2
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 e3a234593c5f50965e1440dbf2738d2fdd99c675326fee12d2047924b1de04c4
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.2MB
                                                                                                                                                      • SHA256 5b03d035e562681ae07dced5e4f21b7b5e3fdc4a8f9448b2036b8d275475c2ec
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.1MB
                                                                                                                                                      • SHA256 8b0d1ba4a4d97155c329ff0f9abff73eec60b1a8f3165028c91eba6a80ef065f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.1MB
                                                                                                                                                      • SHA256 081ef9e7ceb8f4f05c0142d72d4c297268ee1d00b34f3c22606e8950ed3c287a
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.1MB
                                                                                                                                                      • SHA256 7479d897897ae44041e7264f33f647dddba427cd3ee7e86c17bdd0fc40032a83
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.0MB
                                                                                                                                                      • SHA256 cdf506d771d367629c2d6eab21c88f5c590eb1cf1e48aa7a42477a4551ad9a4a
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.0MB
                                                                                                                                                      • SHA256 e0856288b3c971bf44f22d585d391a125f01a8c8e1515fd7ec40a8d78c9b7edf
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.6MB
                                                                                                                                                      • SHA256 aa91d271fcb91b597d61f0d722a82da5690b7e09132a0dd0f272bc3d778d6439
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.6MB
                                                                                                                                                      • SHA256 8501be23e91029b70f44de2804caa3479d367038af0ed86c2208a8b8c01b7863
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 cff0765f4208fe3da7bbb25b90e2f324e8fd94a3e693131a9b714dd016fdc02f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.3MB
                                                                                                                                                      • SHA256 78ac272ee5b53bdbd4123a84469232177e82dfecaa6df0915ebd28b699fd2b56
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.5MB
                                                                                                                                                      • SHA256 8bd9579cc518fba69a80503e304a3c2f491e412c712ce8663a676884850c9c3b
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 689ac7ac6820098ee53264a2b950a24918df3e904cf1a8d2cccb7c5c6246dacd
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.5MB
                                                                                                                                                      • SHA256 1e82de81ffcf081d060ac05a0379f81552f232a6bd1bf82a7a7d7e56fed2775e
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                      • Size 4.4MB
                                                                                                                                                      • SHA256 b6b3e2cd3b57b6e296fa76129b785c69c20830fc65920866b5e6aa483902eccc
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Logo1_.exe
                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                      • Size 32KB
                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      _desktop.ini
                                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-681733028-2344970462-962213935-1000\_desktop.ini
                                                                                                                                                      • Size 9B
                                                                                                                                                      • SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                      Submit Download

                                                                                                                                                      memory/60-10730-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/316-5685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/392-10439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/396-10580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/656-6239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/740-7887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/856-10760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/880-10505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/976-10660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1008-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1056-1893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1092-10545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1124-10399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1176-10715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1180-3147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1220-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1220-819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1220-2510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1220-5686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1352-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1364-10407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1456-10431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1468-77-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1472-10550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1492-10650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1504-10640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1516-10465-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1544-10423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1624-6223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1676-10776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1692-7449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1712-6199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1716-2696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1776-10695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1808-10782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1808-10777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1856-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1856-1889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1872-10605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/1908-9151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2152-10740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2168-10645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2204-5690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2228-10680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2308-10750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2324-10610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2420-2521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2424-10575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2432-10459-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2440-7191-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2448-10386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2496-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2496-13-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2508-10520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2512-4421-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2516-10444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2592-10525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2656-10595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2736-10535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2788-10411-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2836-10745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/2896-10720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3092-10630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3152-10705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3220-6227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3280-6235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3284-10540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3296-4566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3344-10449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3364-10725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3516-6243-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3520-9909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3608-6203-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3676-10765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3680-6211-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3720-10570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3832-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3936-5585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/3968-10403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4016-10470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4028-10435-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4036-10635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4052-10475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4148-10415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4164-10510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4252-10490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4284-10771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4288-7689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4300-6207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4360-5681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4452-10495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4464-10500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4488-6945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4540-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4644-1900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4696-10665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4780-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4884-2886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4924-10625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4960-8953-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4972-10735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/4984-10560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5040-10690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5064-10655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5100-10454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5116-10427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5152-9363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5164-6219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5204-10585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5304-10565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5320-10480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5336-10590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5356-10615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5452-10600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5472-10555-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5488-2781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5576-10395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5660-10670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5676-6231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5680-5416-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5700-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5748-443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5776-10685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5784-61-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5880-10390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5896-10620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5960-10755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/5980-10530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6004-10700-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6020-8507-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6024-3190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6028-10419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6032-6195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6036-10710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6040-10485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6056-2327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6068-10515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6092-10675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download

                                                                                                                                                      memory/6108-4851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                      Download