Overview

overview

8

Static

static

3

ceedff9753...a6.exe

windows10-2004-x64

8

ceedff9753...a6.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 09:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
  • Size 5.2MB
  • Sample260925-k41dnst13m
  • SHA256 ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1408
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4925.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5300
          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5356
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a599F.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1068
              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2696
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6577.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:1280
                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5796
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7313.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:5520
                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:5500
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E3E.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:6092
                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4328
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87D4.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:3952
                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:2496
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9428.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3852
                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2556
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98FA.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:6032
                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5388
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:3248
                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:5280
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA54E.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:4420
                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:2488
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC34.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4108
                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6016
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB22F.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5804
                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4572
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA2E.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:5620
                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2028
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1B0.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1048
                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3268
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC867.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5920
                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4808
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF8B.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:6064
                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:3552
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5A5.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1120
                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4300
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC9B.bat
                                                                              38⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:5976
                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4552
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2C5.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2980
                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4148
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8B0.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4664
                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4424
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF29.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1464
                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4264
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF052.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2692
                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2388
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF12C.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2220
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5032
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF226.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5516
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2460
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF301.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5384
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2948
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF3DC.bat
                                                                                                              54⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3016
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2668
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF4C6.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5240
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2416
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF591.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3220
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1560
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF66C.bat
                                                                                                                          60⤵
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3424
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5824
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF737.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1696
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4836
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF841.bat
                                                                                                                                  64⤵
                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5632
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3684
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF95A.bat
                                                                                                                                      66⤵
                                                                                                                                        PID:4308
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:6040
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFA64.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:2432
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:5248
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB3E.bat
                                                                                                                                                70⤵
                                                                                                                                                  PID:3020
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:3324
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC19.bat
                                                                                                                                                      72⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:916
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4272
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCF4.bat
                                                                                                                                                          74⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:2140
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                            75⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:1132
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE0D.bat
                                                                                                                                                              76⤵
                                                                                                                                                                PID:6132
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:1804
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF46.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:1168
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:1692
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:2056
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:3592
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10B.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                                PID:2532
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:4520
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a234.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:476
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:5108
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35D.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:4056
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:1212
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a495.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5704
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                              89⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4632
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a560.bat
                                                                                                                                                                                                90⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:984
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                  91⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  PID:4816
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61C.bat
                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:6008
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a716.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:2524
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4704
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a800.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:1432
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:4644
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FA.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:3868
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:1308
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:4708
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA90.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                PID:3228
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:3636
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6B.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                      105⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      PID:2084
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC65.bat
                                                                                                                                                                                                                                        106⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:2472
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4548
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD40.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                              PID:760
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:2408
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1B.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                    PID:1112
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:4280
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF5.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                          PID:1128
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:3656
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEF.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:616
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10BA.bat
                                                                                                                                                                                                                                                                  116⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1176.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5000
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:4464
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1260.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:2120
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:5580
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a131C.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:1208
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a13D7.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                      PID:5748
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:4776
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14C2.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a156E.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:5928
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:3944
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1658.bat
                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:1448
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:4696
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16F4.bat
                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                        PID:2904
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                          133⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17A0.bat
                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:244
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                PID:3488
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a186B.bat
                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                    PID:5512
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                        PID:5584
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1927.bat
                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:5540
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:4920
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19D3.bat
                                                                                                                                                                                                                                                                                                                              140⤵
                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                    PID:6076
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AAD.bat
                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                        PID:4244
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                          PID:3428
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B78.bat
                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                              PID:5980
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C63.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:2872
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3788
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D1E.bat
                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                            149⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:4904
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DDA.bat
                                                                                                                                                                                                                                                                                                                                                              150⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                  151⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:3208
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E95.bat
                                                                                                                                                                                                                                                                                                                                                                    152⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:3856
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F70.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1336
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:3052
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a204B.bat
                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:1828
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:1108
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2106.bat
                                                                                                                                                                                                                                                                                                                                                                                158⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:1140
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1868
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21A3.bat
                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                    PID:3728
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:4296
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a224E.bat
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                            PID:788
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a231A.bat
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:4320
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2481.bat
                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2008
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a253C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:620
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2636.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a283A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2905.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a29C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A8C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B38.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C8F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3039.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3104.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a322D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a33B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a346F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a350B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35C7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3673.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a372E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37BB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3886.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3970.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A2C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D0A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DA6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4027.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a416F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41FC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4288.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4315.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a442E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4567.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a476A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4884.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a493F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A78.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B04.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EAE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FF6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5092.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a512E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                          • C:\Windows\Logo1_.exe
                                                                                                                                                                                            C:\Windows\Logo1_.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Creates a file in the Startup directory
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            PID:3620
                                                                                                                                                                                            • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                              net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                              PID:3632
                                                                                                                                                                                              • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:2496

                                                                                                                                                                                          Network

                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                Downloads

                                                                                                                                                                                                $$a4740.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4740.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 2937ba18c99b07fd36abf6f7c6f63b4577ad173b5579fc0deaa856b75b35f00e
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a4925.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a4925.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 298dec3031b7cba29b8af806099fbc5d325834b429a030018916d4ea4f1de19d
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a599F.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a599F.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 064e2ed70d4496325610fa20e071cee6ead8ec0acde4c9ead67e5821cb270162
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a6577.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a6577.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 32b67ded613f444382084d172aa99f754afd567384d4394fe24b65e11abe9d50
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a7313.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7313.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 a9f8e27e943fc09d8fc3d06e9238965a9871b0afe2c43d0bf24e97cce86353fc
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a7E3E.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a7E3E.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 df9106d3990c97d3c1e3dbfea8b24905d9832574ef900621798c4aabce8885bd
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a87D4.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a87D4.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 1227eddad606cbfb9fc0f2616097aa6b6108a17a5a938469bc0376c826c94a9a
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a9428.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9428.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 5ce6ce6351df0fbd6623452753095740d9e7201f86d6858d4eb73aff15df67c3
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a98FA.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a98FA.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 c96fb4a95f1fcdfb455eb39096ff74a43b3e268588bbd29d13321c5c2b55f9cc
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$a9E1B.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 cfa97bd4798f16fbede34db9ad49aa60c5c2a503dae64e1411fbed237b68cdb5
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aA54E.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aA54E.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 9c2275bab98bc815e36816b4c4e523258b995f08841968c70511ba3d455de692
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aAC34.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aAC34.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 2ae5d0048d7dc97ba945ed0c067b6bbde7eb82904ed2121361f46054b84c0cc4
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aB22F.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB22F.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 99af9294761c564795c428cb24cdf5a6cecb1dc71efe0045c34731e2be32836b
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aBA2E.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aBA2E.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 14cbd9299b2442bfdff7821802a06133a2c5d53d8c87bbef974b166d8c31747a
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aC1B0.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC1B0.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 06d6c2395c23b1ae9d3671a196348ff0ab12bc011a444e27497522491a43d026
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aC867.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC867.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 e43da6413395f93517b30cacdf807ff0a07bb7518a42937b7cf2de3c27f5293f
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aCF8B.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCF8B.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 4ab7a67e080cd4954ad6c875d1931a23ae791d76e610a3c9c466d8ecdb96b042
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aD5A5.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD5A5.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 6ad116541bd7f2409adcf206571a527c62c6762cfab551ca8760d0becbb9db94
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aDC9B.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDC9B.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 b20f249342ace492d9c9afdb2da2a1efa5669a6c05051f9a328acac161cb8abc
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aE2C5.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE2C5.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 61fe2fb7520b2ad7c90660af3f80253ae16c55ee3e8da7fb47e1aa4cdbf922b3
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                $$aE8B0.bat
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE8B0.bat
                                                                                                                                                                                                • Size 722B
                                                                                                                                                                                                • SHA256 58fefe293d77af2318153f2f66ebcdfdc460e45cb93d1d20bdd4ed072f20f909
                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                • SHA256 f0ce03bfff931de4582729ac720827e455f608ae5bb9f421d60e99b5666643f9
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                • SHA256 7cc7d6085926473a7a52eff52f35601c57e974961d9f06800efdb86063096b94
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                • SHA256 5d105fe3741b6457a3fc7f3e6e8e2859c3b412bf18607f293bee35e05576b396
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                • SHA256 909fc782fa13d4005645fb68f488149fd260bb0c8a27004093e4d09939ffbad0
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                • SHA256 dcfdb87dbf1030398d17b0c314cbb8014dec7a494d663407755b6697a87edbe0
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                • SHA256 d2c25c46f17efbc6385b95ba66ed8cafaf8bc2e2c96e11a384ba0e6bd408b1dc
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                • SHA256 2e4bf77e51f52e7c3b1c572210303d31db46fb737448c640a890746d0666386a
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.9MB
                                                                                                                                                                                                • SHA256 99df66b42260535b6694baf11c4de38196c8785af07cd6965a575d13348f0f9e
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.8MB
                                                                                                                                                                                                • SHA256 19cfe6491ac57826cc892e2d71e47b4b16091c8adff661bd733b4556b3cdac5b
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.0MB
                                                                                                                                                                                                • SHA256 d08c25d39bc9ab93abbdba108aa0fa4d69b20d653ca6a64a850cdb7d14d46f31
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.8MB
                                                                                                                                                                                                • SHA256 76e8a2e9319cc9a1805665c1b953944d86af1c407fcdca73792a581d05786233
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                                • SHA256 f6553c0f4b977f03347ea2daf64387c0ece544fe1d4cc93f11edd2e3f87df3f0
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.8MB
                                                                                                                                                                                                • SHA256 ebdba4afa2123fc08f68bd8eb55ea720db47aadc0e77cd7ca4cb2aa9c0122c49
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                                • SHA256 ed2bb2a6b2105f24f07217038ff16a6a674fc22899d51ef358c1e750e4062ca6
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                • SHA256 25cf2e0d8aa5075cc04118362f1ed1146d593fdcae1dbbb4227875c31e588219
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                                • SHA256 0e70b5c1ec9f526935b50c2161f375afc9792af4949d1a5f45c782ed9052102e
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                                                • SHA256 9c90f23574fe9bbb7abc0fcfb976f2787e45fc8a3e692f5d8e4d22de89e7e03e
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.2MB
                                                                                                                                                                                                • SHA256 aff84ad3aa24c97d7a31ada6bf8c220679a9eef26cadc0ad0337cc96d365fe67
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                                                • SHA256 7a9b03495406beac5c3079f9caf86baaca0b6a580c60b9a3e28bca688a01030b
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\ceedff97536c6a6e8770dc7d2058ac01bd62adadf437805a21a79e7c61ff40a6.exe.exe
                                                                                                                                                                                                • Size 5.1MB
                                                                                                                                                                                                • SHA256 e9fac14627c9e478c05b4d09afcbbd15e10f138e7307d3adf642c4e89408a58f
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-1404337215-1550464601-2805570857-1000\_desktop.ini
                                                                                                                                                                                                • Size 9B
                                                                                                                                                                                                • SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                memory/128-8550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/616-8298-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/620-8460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/708-8575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/720-8599-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/788-8436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/896-8767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/988-8701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/992-8833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1064-8514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1096-8484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1108-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1132-8197-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1180-8683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1192-8647-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1208-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1212-8227-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1308-8257-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1312-8328-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1320-8508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1408-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1452-8737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1560-8157-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1576-8623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1692-8207-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1712-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1716-8593-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1752-8821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1760-8605-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1804-8202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1840-8773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/1868-8424-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2028-8061-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2084-8273-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2100-8797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2388-8127-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2408-8283-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2416-8152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2460-8137-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2488-8036-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2496-8001-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2528-8719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2536-8532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2544-8665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2556-8012-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2624-8755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2668-8147-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2672-8442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2696-1809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2824-8544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2828-8556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2852-8569-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/2948-8142-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3012-8695-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3052-8412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3060-8659-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3116-8526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3208-8400-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3224-8496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3264-8815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3268-8069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3324-8187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3344-8538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3360-8478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3404-8581-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3408-8677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3428-8376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3444-8653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3456-8839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3484-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3484-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3488-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3552-8085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3592-8212-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3620-3223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3620-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3620-8005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3620-1804-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3636-8268-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3656-8293-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3684-8172-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3788-8388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3820-8761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3856-8406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3912-8563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3928-8846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3928-8852-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/3944-8334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4068-8743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4148-8111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4192-8303-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4228-8520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4236-8611-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4248-8827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4260-8346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4264-8122-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4272-8192-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4280-8288-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4296-8430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4300-8093-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4328-5996-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4384-8791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4424-8117-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4464-8308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4468-8502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4520-8217-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4548-8278-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4552-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4572-8052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4612-8725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4632-8232-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4644-8252-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4696-8340-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4704-8247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4708-8262-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4776-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4780-8689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4800-8779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4808-8077-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4816-8237-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4836-8167-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4900-8635-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4904-8394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4920-8364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4936-8629-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/4944-8749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5004-8845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5016-8707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5020-8587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5028-8731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5032-8132-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5108-8222-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5224-8617-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5236-8713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5248-8182-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5276-8803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5280-8028-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5356-46-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5388-8020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5456-8641-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5500-5527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5552-8466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5580-8313-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5584-8358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5608-8671-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5660-8382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5696-8472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5796-3851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5824-8162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5892-8785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/5904-8809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/6008-8242-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/6016-8044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/6040-8177-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/6048-8490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/6060-8454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download

                                                                                                                                                                                                memory/6076-8370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                Download