Overview

overview

7

Static

static

3

7a55f076aa...44.exe

windows10-2004-x64

7

7a55f076aa...44.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 06:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
  • Size 4.6MB
  • Sample260925-hdvdmasbkh
  • SHA256 7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB126.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1084
      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5648
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4EE.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4836
          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1184
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5116
              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1352
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4304
                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2108
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE07.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5700
                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4652
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC049.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5588
                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2428
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2E9.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5596
                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2536
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC598.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1404
                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4312
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD97.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:4460
                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:3572
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1FC.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4768
                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1292
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD45D.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5180
                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:3756
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE67E.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5108
                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4716
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE833.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1300
                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1980
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC5A.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3564
                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1304
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE7D.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4528
                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5616
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF080.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3024
                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4232
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43A.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5872
                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5836
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF6E9.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3916
                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1232
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF95A.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5680
                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4968
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB7D.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5600
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5892
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC38.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4256
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:612
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD23.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2548
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5696
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFDEE.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5164
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4588
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFED8.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5584
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4100
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFFB3.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1860
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3328
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:6096
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2572
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13A.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:940
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1064
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a224.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2700
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3012
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FF.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3484
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4628
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DA.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          PID:3248
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:4328
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D4.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2500
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2432
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BE.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  PID:420
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3404
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a689.bat
                                                                                                                                      66⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:868
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:3040
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a773.bat
                                                                                                                                          68⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5860
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5432
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84E.bat
                                                                                                                                              70⤵
                                                                                                                                                PID:1708
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5344
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90A.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:2452
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:5768
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D5.bat
                                                                                                                                                        74⤵
                                                                                                                                                          PID:4552
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:3204
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA0.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:1484
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:1496
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:3000
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:912
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC46.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:3388
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:2624
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF2.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3772
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:4940
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:3524
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5884
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:2916
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:2660
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF43.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            PID:4576
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:5488
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEF.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                  PID:4316
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:3748
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10AB.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1166.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4040
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:5992
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1222.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:4108
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:2756
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12CE.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:3732
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1389.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                        PID:1900
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:3444
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1435.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5284
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:5888
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14E1.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4824
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15BC.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:5848
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1677.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:6136
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1713.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:4196
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                              111⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4068
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17B0.bat
                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                  PID:5492
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18B9.bat
                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4084
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1965.bat
                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:1276
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A01.bat
                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:2496
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A9E.bat
                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                    PID:4112
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:5340
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B4A.bat
                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                          PID:2156
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3224
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C15.bat
                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5456
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1CB1.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:5440
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3480
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D5D.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                        PID:5748
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:1796
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E18.bat
                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                            PID:6092
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:4532
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EC4.bat
                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:4996
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  PID:3244
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F8F.bat
                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:808
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a206A.bat
                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                          PID:3624
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2106.bat
                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21C2.bat
                                                                                                                                                                                                                                                                                                                      140⤵
                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:5776
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                        141⤵
                                                                                                                                                                                                                                                                                                                          PID:2404
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22BC.bat
                                                                                                                                                                                                                                                                                                                            142⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                              143⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:5740
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2377.bat
                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                    PID:1944
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2452.bat
                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                        PID:5216
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                            PID:200
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a253C.bat
                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:4764
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:4444
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25F8.bat
                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:3092
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26E2.bat
                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:264
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2112
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a279E.bat
                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:2784
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:3232
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a283A.bat
                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                      157⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28F6.bat
                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                          PID:5204
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4624
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29A1.bat
                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                PID:5056
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:3304
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A5D.bat
                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:1072
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:716
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B38.bat
                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:3528
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1604
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BE4.bat
                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C80.bat
                                                                                                                                                                                                                                                                                                                                                                                                    168⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                          170⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3029.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3296
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31C0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1868
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a328B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3346.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33E2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a353A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3673.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a370F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a379C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3847.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B16.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CEB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4037.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4160.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41EC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4298.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4334.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a444E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4596.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4632.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a474B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4884.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4920.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5720
                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                      34⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                      PID:1564
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                        35⤵
                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                        PID:52
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                          36⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:1484
                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:4248
                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                        3⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                        PID:1164
                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:4980

                                                                                                                                                    Network

                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          $$aB126.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB126.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 884bcc593110f629145ce48cde2af6df07a806a5058239854a8089c9a18481a3
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aB4EE.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB4EE.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 ea7dd1765ff8a6cb7a26ca2340956de41e26e5443ae00b62d9a5c2daa54f0095
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aB963.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB963.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 f3adae8fac1b1821c72031177db703d99a16407641506d543aaffa6a63c4762b
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aBB67.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBB67.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 5a0021a808eba6963453aec6cb5435146c209a6114bdefb3d0f35e86279eb207
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aBE07.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aBE07.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 899d2e18f6225809c9fc8005d57c26ace0df3860ac09b59644400e750f1c5e53
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aC049.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC049.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 466e1fdc2c6cf67ffa70bd0ebcfde3d32b157a529de9009772c347dfd470f9f9
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aC2E9.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC2E9.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 ae623c2bc73e514e91f1060d2463ba9d46b84809b21b31000a0881a464703460
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aC598.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aC598.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 c65b58ea17d4fdc4bb4a714813387b7a2d262c39755b28c234da58b94af4cbd4
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aCD97.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aCD97.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 eeecdf12ac6f5af98c2424e80385c2cf0e1d58ec5aa58641538bc4f51a88a5f8
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aD1FC.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD1FC.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 b0ca0f049a17d41b95e4bb45461e3e955e5017f4f3b99739d2b759619a91d6cf
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aD45D.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aD45D.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 c32f4f7e12022c9d2172a88aa552ee72c91b43b619f55d12352bac5d1ab8d602
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aE67E.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE67E.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 f2a4afc991146f429ee1f4cd3d8377cb43ffa9204d39323f19e69982af875720
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aE833.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE833.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 22e5c84723ca8a7557d999324e921a5b2e90d2a6b3d1563cc024bcec5ce28018
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aEC5A.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEC5A.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 7dfaec0cbaf7d347a836b0cc107815a6d176a9e5fc8fd129447e500e0c5d7132
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aEE7D.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEE7D.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 ad7a0ac0cfaa2b849df88d11ca1524d0f947f42fbeaa4236cb473d61b4289fc4
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aF080.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF080.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 08e8916307ec00e664c21a6c2eca2303f85175ec279cc775c3e432dca3dedd73
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aF43A.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF43A.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 83ab3bb87f3a616d0875b28cce4005b3f23434e498ee63d621d0200b84cf7ed7
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aF6E9.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF6E9.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 a42e4353236aeb386ba43ecae3677fece36485fa6a0b3960bee4dbaaaf92a36b
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          $$aF95A.bat
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF95A.bat
                                                                                                                                                          • Size 722B
                                                                                                                                                          • SHA256 325114f48e587c87022a764c7f5551e46bd512ff2b22abc9858de82665738e6b
                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.2MB
                                                                                                                                                          • SHA256 b53136367a1fa5242fa2b1181bd96f8e814412fba819e34965f763dcad5c3ffc
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.2MB
                                                                                                                                                          • SHA256 e3a234593c5f50965e1440dbf2738d2fdd99c675326fee12d2047924b1de04c4
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.1MB
                                                                                                                                                          • SHA256 081ef9e7ceb8f4f05c0142d72d4c297268ee1d00b34f3c22606e8950ed3c287a
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.1MB
                                                                                                                                                          • SHA256 8b0d1ba4a4d97155c329ff0f9abff73eec60b1a8f3165028c91eba6a80ef065f
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.1MB
                                                                                                                                                          • SHA256 7479d897897ae44041e7264f33f647dddba427cd3ee7e86c17bdd0fc40032a83
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.3MB
                                                                                                                                                          • SHA256 fcfcb85e8416087a6e4179dec31516855c53daf0a664ad79ab7ba890ef435321
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.3MB
                                                                                                                                                          • SHA256 78ac272ee5b53bdbd4123a84469232177e82dfecaa6df0915ebd28b699fd2b56
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.2MB
                                                                                                                                                          • SHA256 21c9b9e46e555f501f5858a78b576be0c488db930b3ce71dc59821fb6c1fa5c2
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.6MB
                                                                                                                                                          • SHA256 aa91d271fcb91b597d61f0d722a82da5690b7e09132a0dd0f272bc3d778d6439
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.5MB
                                                                                                                                                          • SHA256 8bd9579cc518fba69a80503e304a3c2f491e412c712ce8663a676884850c9c3b
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.6MB
                                                                                                                                                          • SHA256 8501be23e91029b70f44de2804caa3479d367038af0ed86c2208a8b8c01b7863
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.4MB
                                                                                                                                                          • SHA256 b6b3e2cd3b57b6e296fa76129b785c69c20830fc65920866b5e6aa483902eccc
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.2MB
                                                                                                                                                          • SHA256 5b03d035e562681ae07dced5e4f21b7b5e3fdc4a8f9448b2036b8d275475c2ec
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.5MB
                                                                                                                                                          • SHA256 1e82de81ffcf081d060ac05a0379f81552f232a6bd1bf82a7a7d7e56fed2775e
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.5MB
                                                                                                                                                          • SHA256 baeda72c0d6b22d3d9c62801d7730fa8e935efc4d4ca48e45bc83876be3bddcf
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.4MB
                                                                                                                                                          • SHA256 cff0765f4208fe3da7bbb25b90e2f324e8fd94a3e693131a9b714dd016fdc02f
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.4MB
                                                                                                                                                          • SHA256 689ac7ac6820098ee53264a2b950a24918df3e904cf1a8d2cccb7c5c6246dacd
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\7a55f076aa79ce997cdd2f1eca7a2900f3aa4de954d0396bc123ed0374118a44.exe.exe
                                                                                                                                                          • Size 4.3MB
                                                                                                                                                          • SHA256 3126ab17077daa89a80b3d69e11415c2d012074d695721b928417b254a647648
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          Logo1_.exe
                                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                                          • Size 32KB
                                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                          Submit Download

                                                                                                                                                          _desktop.ini
                                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                                                                          • Size 9B
                                                                                                                                                          • SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                          Submit Download

                                                                                                                                                          memory/200-6468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/236-6801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/260-6807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/472-6753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/560-6789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/564-6710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/612-6195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/628-6582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/716-6516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/804-6606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/808-6432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/912-6286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1064-6226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1168-6594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1184-35-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1232-6178-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1292-1866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1296-6618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1304-6061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1352-49-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1360-6624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1420-6692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1436-6747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1496-6281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1564-6216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1564-6392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1604-6522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1688-6795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1692-6704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1796-6414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1824-6570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1832-6540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1868-6576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1892-6666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1944-6462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/1980-6053-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2108-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2112-6486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2116-6648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2184-6698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2236-6716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2284-6630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2304-6654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2404-6450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2428-79-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2432-6246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2504-6636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2536-87-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2556-6808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2556-6814-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2572-6221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2604-6558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2612-6680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2624-6291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2660-6306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2732-6777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2756-6331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/2912-6729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3012-6231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3040-6256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3204-6276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3224-6397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3232-6492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3244-6426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3304-6510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3328-6215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3404-6251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3444-6341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3452-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3452-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3480-6408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3572-1858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3644-6672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3732-6336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3748-6316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3756-5576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/3852-6660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4068-6366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4084-6376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4100-6210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4128-6783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4136-6686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4232-6157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4244-6371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4248-6145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4248-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4248-1131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4248-3091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4312-1166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4328-6241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4444-6474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4456-6678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4532-6420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4544-6438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4564-6723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4588-6205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4604-6498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4624-6504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4628-6236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4640-6765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4652-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4664-6552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4672-6386-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4684-6534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4716-5584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4752-6546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4828-6735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4856-6741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4864-6480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4940-6296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/4968-6185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5024-6381-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5060-6771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5104-6759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5260-6321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5264-6528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5268-6444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5340-6391-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5344-6266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5360-6642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5432-6261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5436-6588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5456-6402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5488-6311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5616-6073-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5648-19-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5648-24-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5696-6200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5740-6456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5768-6271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5804-6600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5836-6168-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5848-6356-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5884-6301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5888-6346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5892-6190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5948-6612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/5992-6326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/6020-6351-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/6088-6564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download

                                                                                                                                                          memory/6136-6361-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                          Download