Overview

overview

7

Static

static

3

bf5ba21828...a4.exe

windows10-2004-x64

7

bf5ba21828...a4.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 07:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
  • Size 5.7MB
  • Sample260925-httf9sbg35
  • SHA256 bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89D7.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4936
      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:5436
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5412
          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3864
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91E6.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5920
              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:4120
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5844
                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1728
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a990A.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5932
                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:5904
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C75.bat
                          12⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3892
                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3040
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA88B.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4380
                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:2620
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3556
                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1120
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBED2.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:6008
                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2748
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC47F.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5764
                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:5604
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFAA.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3568
                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2432
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7D8.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5736
                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4196
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE18C.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5704
                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2128
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8DF.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3976
                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2776
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF061.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4904
                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3984
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF91C.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3920
                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5004
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E6.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2984
                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2964
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F0.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3288
                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5424
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1B.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4876
                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3220
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12AE.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5360
                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3416
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a185C.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5952
                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1560
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2099.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3408
                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1288
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21C2.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4860
                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:404
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a229D.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:6024
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4812
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23C5.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5968
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2708
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24CF.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:6108
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:996
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a25E8.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1888
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5560
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26E2.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1304
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1160
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27FC.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5508
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2516
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2963.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3768
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:1176
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A6D.bat
                                                                                                                              62⤵
                                                                                                                                PID:5228
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:2700
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B95.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:3724
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:6052
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C9F.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2876
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1632
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DC8.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:4100
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:5472
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F10.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:5128
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:5096
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a301A.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:5324
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                            PID:620
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3171.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:556
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5232
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a328B.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:5132
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:2668
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3421.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:552
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:2836
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3559.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                  PID:4728
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:3764
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3682.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      PID:5960
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1384
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37BB.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                            PID:5784
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              PID:1828
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38A5.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                  PID:3468
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:2252
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39DE.bat
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:4932
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3404
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AC8.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                            PID:2144
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:6068
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BD2.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CCC.bat
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                      PID:828
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:576
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DE5.bat
                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:5100
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F4C.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4075.bat
                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:264
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:5624
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41BD.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:2460
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2548
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42B7.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:6100
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43F0.bat
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                    107⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:568
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4528.bat
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4488
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4651.bat
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:1832
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:1004
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a476A.bat
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:4528
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4884.bat
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5692
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:5708
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a499D.bat
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:712
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AB6.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                            PID:8
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C1E.bat
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                PID:3164
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D37.bat
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:3320
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E40.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:1656
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F0C.bat
                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                              PID:4564
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:4352
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5025.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:5812
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                      PID:52
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a511F.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                        PID:4644
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:5404
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5267.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                  PID:3692
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5361.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:2720
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a547A.bat
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:3120
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:4180
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5565.bat
                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                              PID:4516
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a566E.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:296
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5787.bat
                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                        PID:3752
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                            PID:240
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5872.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              PID:244
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:4324
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a595C.bat
                                                                                                                                                                                                                                                                                                                                                  146⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2628
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6072
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A85.bat
                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                        PID:788
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B9E.bat
                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                              PID:916
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:1252
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D63.bat
                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:5568
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E2F.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:472
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2340
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F38.bat
                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1068
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2816
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6023.bat
                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:600
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a611D.bat
                                                                                                                                                                                                                                                                                                                                                                                              160⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6217.bat
                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a634F.bat
                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a642A.bat
                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6505.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a665C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:880
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6727.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6831.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1900
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a690C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DDE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3772
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a704F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a713A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7243.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a736C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7456.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7560.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a764A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7735.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a782F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7919.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EE6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82DD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8399.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87FE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B98.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D9B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F60.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a902B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9154.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a923F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9684.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a976F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a982A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ABB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F00.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA171.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA23C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA356.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA421.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA50B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA76D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA857.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA941.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9FD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD68.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEA0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF5C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFE8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1960
                                                                                                                                                                                                                                                  • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                    C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Creates a file in the Startup directory
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                    PID:1000
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                      net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                      PID:708
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:6128

                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                        $$a12AE.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a12AE.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 8826aa0bff1e0729b348508c3b69c46f8f3d86e254de4ceee249c2510b2b94e4
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a185C.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a185C.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 91f7082c3d48d17a4cc125449b238a84736bc11aa3e995fb02d6150dccc8c71e
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a1E6.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a1E6.bat
                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                        • SHA256 b5b556bdd6bbc078b66066a5ee2156fc6037bebdcef801841944b1b5727f9f3b
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a7F0.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a7F0.bat
                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                        • SHA256 732bf1a456f9d2e736cba33a596ab1ed2c962c4991e015c8b5575d32ecc5d611
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a89D7.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a89D7.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 6d06a15f1fd1c93889237c9c26cf6a959a8c60991151d601f9dc643dfc28b69f
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a8DCF.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a8DCF.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 0331a4de7795aeec7701ff3617677ecc4916c882d1711f6265d62df436cba1d4
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a91E6.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a91E6.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 669799792e6d8e47b5ddef94266dfa1bbc79e5ed11fc235b4fde73dc87456d65
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a9560.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9560.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 183038a88bbb4f8d6ad1a3b035b33a22012d0cedbf3a4d912d9e74207645b0da
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a990A.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a990A.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 b81f2e833a0755a0a0473bc8e16a094f88d8cc353e3ac1eda5226feecc94973c
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$a9C75.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$a9C75.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 ccfe3ae5106046fea2e9d801bca25af5b48b1da5f9bcaa3941e29e1ab5a78365
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aA88B.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aA88B.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 8e28792b0097c436460e1010e61a82bc25d09c71e7686989d6ab4e1bde266425
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aBD2C.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aBD2C.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 daf765fb931c9539d8769c2aac304fc3bc1a86507bb63ec174b60b46f073608e
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aBED2.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aBED2.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 ad78cb292eafb9205bf9d02310b03e2d04abaf4e01b44aefec013a83336f0dc9
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aC47F.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aC47F.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 81f51dffa3e8843eb3ceb852bb915c6418378a3814ccf8b843c147a3ee55c48d
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aCFAA.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aCFAA.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 e11b25207c504b616aa438eca2e7c345497d3251722b29422c3ee5f78f2481d3
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aD7D8.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aD7D8.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 d03f347b850bfb705d9be1c0e0c38a8396182e3d1c7504db71abca2f9d5f3970
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aE18C.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE18C.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 e09fbeeebb3754f74fdfee99fb36866fbdb0b9d9c263d1b15cd742fdd25dcad0
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aE1B.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE1B.bat
                                                                                                                                                                                                                                                        • Size 721B
                                                                                                                                                                                                                                                        • SHA256 83a528a6ce5d6e19f081f40b7c573c78187acdfa06e4741c35fd2299039c92f8
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aE8DF.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aE8DF.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 a0549f2c6c8be6233dd06588a555a0d63c3ce26b7b431c32f16426b2fa2b170b
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aF061.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF061.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 afa90d5c01be91206932c73812d7fe920ce3739c24ad56c818f1f815ca1fe266
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        $$aF91C.bat
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\$$aF91C.bat
                                                                                                                                                                                                                                                        • Size 722B
                                                                                                                                                                                                                                                        • SHA256 df380699d9eb4b72dac3e6e71ac3dd4d753f90c765b39e3ce133d62858ae02e5
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                        • SHA256 8f35c42f8029bb68e1f21306b6164d4783771f0e9ebb69ff76dd1533291492c6
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                        • SHA256 79f651faa671a7f3033d12b8e23acaab6380b3c654b2839a9241a2371c48752a
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                                                        • SHA256 2f91c5db962f57ca6822b6d721e4d6a8fc5479f68d820ac622ae5b599d52bf0e
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                        • SHA256 fa940bb5b3d015e79f721617707a5b50693432de94d2397bd24503fc1648c2f4
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                                                        • SHA256 ac5dca7d33e597cea36707c8723c318dffd35a106c37cb63deec73ed2461e71a
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.3MB
                                                                                                                                                                                                                                                        • SHA256 db14d9fefe4f59ae902f4635879337c6c663dcf063b08a2eb4a43d5ee3dfb4e8
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                                        • SHA256 77ec4411132c36f84854c314cbd312dc716c3dd990528668ddeb6ab8cb8c36cb
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                        • SHA256 e6714f174525b8d002a16a37e903b31536b574426622bd2dca2de3ae6c4fe80c
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                                        • SHA256 26bc86cb83aa59594034aae6836643d50f530a37be72eaf2ac62cf3e98ca7fe5
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                                        • SHA256 455b59f9495e8a8ea3d653cba0f43c9ec5cb2f8c7a92d9d2b85df51dd92f0298
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                        • SHA256 a266ccbb632822cb1c485b5cd09048ab4b544d5d1843b73988fff4517b3d7e43
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                                                        • SHA256 e089f8d484b8987d5aae19b3ccef517a10da9d1e54dca46ee3b2ebc21262a3f1
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                                                        • SHA256 debdc4ca2ac4e81d0093bec0bbab3ed42ff16022367b53df4b9bd3b373f99ae4
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.4MB
                                                                                                                                                                                                                                                        • SHA256 ae435d2ca85a7ba393e2308c314e65b1132af8c9889e14295cafcd21715472b0
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.1MB
                                                                                                                                                                                                                                                        • SHA256 b0d247beed70b02f50f6fd3f46b4acb6826c6169f742457cf672095ae51170d6
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                                                        • SHA256 91e5daae49e4ba096a04a6cef25b302bf4ae9b061a13eb90f964bc11fc2056b0
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                        • SHA256 d145734b92c1d92e639718958d0dbe078681c6b35328b3606e09b20f17c0c1a7
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.0MB
                                                                                                                                                                                                                                                        • SHA256 ad8dd5d198d6e818f2658645b7961b0c0b709e123273fbf4569ffd728ccad115
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.6MB
                                                                                                                                                                                                                                                        • SHA256 0fb553943bdb85139d505f9821e4614f0e1dc6a71d94b9f80c8fc86590405f5e
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\bf5ba2182889243fdb9a1d71d3ffd7fe0926df260a383651a37b8dc95c421aa4.exe.exe
                                                                                                                                                                                                                                                        • Size 5.5MB
                                                                                                                                                                                                                                                        • SHA256 e56f37e376edcd0a715a5c38c551bd1e0f8816f004d5187dac3ac8b35c072447
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        Logo1_.exe
                                                                                                                                                                                                                                                        • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                        • Size 32KB
                                                                                                                                                                                                                                                        • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        _desktop.ini
                                                                                                                                                                                                                                                        • Path F:\$RECYCLE.BIN\S-1-5-21-2251218687-1689653882-3767565116-1000\_desktop.ini
                                                                                                                                                                                                                                                        • Size 9B
                                                                                                                                                                                                                                                        • SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                        memory/52-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/200-8744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/240-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/296-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/404-8133-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/568-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/576-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/600-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/620-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/628-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/712-8309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/880-8467-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/948-8521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/996-8148-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1000-1828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1000-4157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1000-8044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1000-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1004-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1048-8618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1116-8540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1120-5552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1160-8159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1176-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1204-8762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1240-8455-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1252-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1260-8666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1288-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1300-8714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1332-8648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1360-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1384-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1388-8836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1444-8503-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1448-8756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1464-8774-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1560-8123-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1600-8630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1632-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1656-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1680-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1708-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1728-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1796-8708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1828-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/1900-8479-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2064-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2124-8782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2124-8776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2128-8059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2240-8788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2252-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2276-8606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2300-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2340-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2348-8509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2396-8842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2404-8497-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2432-8042-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2516-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2548-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2620-5544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2644-8515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2668-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2672-8800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2700-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2708-8143-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2724-8612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2748-6021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2776-8067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2816-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2832-8491-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2836-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2880-8684-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/2964-8092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3040-1834-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3080-8702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3176-8732-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3220-8104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3220-8109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3232-8824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3372-8678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3376-8449-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3384-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3404-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3416-8117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3436-8527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3500-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3668-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3680-8726-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3692-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3704-8314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3764-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3864-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3956-8696-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/3984-8075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4120-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4124-8854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4164-8552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4180-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4196-8051-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4216-8660-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4308-8738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4324-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4352-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4356-8672-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4428-8642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4472-8600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4484-8325-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4488-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4504-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4504-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4520-8872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4556-8582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4592-8594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4608-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4664-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4684-8636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4724-8437-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4760-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4792-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4812-8138-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4856-8806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/4996-8794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5004-8084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5024-8654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5032-8848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5036-8830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5096-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5100-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5176-8461-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5232-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5268-8690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5388-8818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5396-8768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5404-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5424-8100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5436-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5472-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5504-8485-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5556-8866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5560-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5568-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5604-7483-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5624-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5672-8319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5696-8812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5708-8304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5876-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/5904-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6048-8534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6052-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6056-8473-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6068-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6072-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6080-8720-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6124-8750-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6128-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                        memory/6132-8624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                        Download