Overview

overview

7

Static

static

3

b22c9e3d0f...99.exe

windows10-2004-x64

7

b22c9e3d0f...99.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/09/2026, 08:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
  • Size 6.0MB
  • Sample260928-klsacazcle
  • SHA256 b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5536
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a423F.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5672
      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4404.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5268
          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5220
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a480B.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3908
              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1708
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B28.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4048
                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1656
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F20.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1412
                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:3516
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51A1.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5800
                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3044
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54FC.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5180
                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4932
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5990.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5584
                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3152
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FAA.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:752
                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3188
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5596
                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3840
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67A9.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:732
                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of WriteProcessMemory
                                                PID:2804
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F98.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4688
                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6104
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71AC.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1288
                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2312
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7555.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4832
                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5852
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A08.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1516
                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3960
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8004.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5860
                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5836
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:452
                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:552
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8553.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1056
                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4588
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8841.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4640
                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1600
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B10.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5768
                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2824
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B8D.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4736
                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5296
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C29.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5020
                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4768
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D04.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1496
                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4756
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DA0.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5876
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1908
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E1D.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1820
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5908
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E9A.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1300
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5568
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EF8.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:664
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:772
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F65.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5228
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3824
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8FE2.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:776
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:4324
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a906F.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2544
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:4468
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a910B.bat
                                                                                                                              62⤵
                                                                                                                                PID:4660
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:4692
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91A7.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:4612
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4648
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9224.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:1204
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3236
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92D0.bat
                                                                                                                                                68⤵
                                                                                                                                                  PID:4560
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                    69⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1220
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a938C.bat
                                                                                                                                                      70⤵
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:468
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                        PID:4636
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9418.bat
                                                                                                                                                          72⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4052
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:5944
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9495.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:1968
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3056
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94F3.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:2028
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:4600
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9580.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:4868
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:3496
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95DD.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              PID:3228
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2960
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a965A.bat
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:3812
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:1536
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9754.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:4552
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          PID:3332
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D1.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                              PID:5244
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a985E.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2020
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4724
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98DB.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:4316
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:4436
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99D5.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:2052
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4140
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A42.bat
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                  PID:868
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:2124
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ACF.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            PID:2768
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:1004
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BB9.bat
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:4088
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:1344
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C27.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                        PID:5580
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                          103⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C94.bat
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                              PID:4236
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                105⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:5780
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D11.bat
                                                                                                                                                                                                                                                  106⤵
                                                                                                                                                                                                                                                    PID:1768
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D8E.bat
                                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                                          PID:6084
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                            109⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4000
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DEC.bat
                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                PID:5984
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:1092
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E69.bat
                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                      PID:2380
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:2580
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EC7.bat
                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                            PID:5748
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              PID:2932
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F34.bat
                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                  PID:5796
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FA1.bat
                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                        PID:4828
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA03E.bat
                                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4860
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              PID:4984
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0F9.bat
                                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    PID:4656
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA212.bat
                                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                                        PID:5772
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:808
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3B8.bat
                                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                                              PID:956
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:4628
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA416.bat
                                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA474.bat
                                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                                          PID:2216
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:2604
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4C2.bat
                                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:1632
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:2860
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA520.bat
                                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:1224
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                                      PID:3120
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA57D.bat
                                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:5988
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                                            PID:4024
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                                PID:684
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA648.bat
                                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                    PID:2364
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6C5.bat
                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                          PID:860
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5088
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA752.bat
                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5512
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2016
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7CF.bat
                                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:2416
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA86B.bat
                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                            PID:5164
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8F8.bat
                                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    PID:5064
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA956.bat
                                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:3368
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                          PID:1028
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA9C3.bat
                                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1152
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                  156⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:112
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB88.bat
                                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1628
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC15.bat
                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE57.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3848
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5048
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB01C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3632
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3720
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB164.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB27D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB377.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB414.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5AA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB646.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB75F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB83A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB925.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB973.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA6D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC13.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDB8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE45.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC029.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC191.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC26C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC375.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC402.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC579.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC692.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC848.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC980.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAC8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDC6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEB0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFC9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD075.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD121.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD23A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD373.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD42E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD577.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD642.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD6BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD73C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD874.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD930.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9AD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAD6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD75.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    326⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      327⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          328⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              329⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  330⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      331⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDEEC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        332⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          333⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            334⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                335⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDFD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  336⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    337⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE035.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        338⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          339⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE0A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              340⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                341⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE13E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  342⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      343⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1AC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          344⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            345⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE267.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                346⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    347⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE303.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        348⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            349⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3EE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                350⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    351⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4312
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                                                                        32⤵
                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                        • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                                                          net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                          33⤵
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                          PID:4204
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                                                            34⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5748
                                                                                                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                              PID:1108
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                PID:3836
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:3720
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 760
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                  PID:4232
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 760
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                                                                                  PID:652
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1108 -ip 1108
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:5320
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1108 -ip 1108
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4940

                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                      $$a423F.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a423F.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 e5a751fa2f675e3619f434a1c065c07da25d86fd195908d7fe014364d6527418
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a4404.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4404.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 4162cb06fface62bb4981163c178579f48bc27f3fdcbbfa3d2f01b488a91aa8c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a480B.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a480B.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 d008e84b44df52eaad2bb26edd43db9bb82e347f02074359c568e2dfac91fce1
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a4B28.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4B28.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 2e4ce84083c365aa3a10932f73b761f0dc7c74ead1b70a1bd3266f0bf9ea1b88
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a4F20.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4F20.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 1e344e05f2b79e367e98c3e1955cfe2f190ed97da5a47485d3e12df6d8e3e350
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a51A1.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a51A1.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 143341702c142d0e499043c3b2cb8781f0d93c576e41073990c8ad1e91b14fab
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a54FC.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a54FC.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 4a83d0f94bfde2ceb4c1ffc8b0467fb03364b8bdb57eb4b39f517e655cba414c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a5990.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5990.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 a5ea646f1105015a75e28c2e4f882289879ee2f90275a56af97afa58af018a33
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a5FAA.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5FAA.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 16ceba09c8220ac0c4f2d1885f6b6ea590fd5a150455ba8f995c377b3182c774
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a63C1.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a63C1.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 c26dab4461c4cc0e61ae36ed141cb03fa28e4e98ff1efafdcb95b7cbaf9ef5f4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a67A9.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a67A9.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 112512a2edbb4973ae79faeda529742f73bc3cee161230c9265b10309b609911
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a6F98.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a6F98.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 bfe5ecbb5ef672520521af7d46fdb41b2575230d614cd814230fe4d1d5953c35
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a71AC.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a71AC.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 90e336452eae610317ba54a1b1d1671eb8dcd7e6c1ed982688dc771fefbb4aa3
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a7555.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7555.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 97ae24eff098167a48014fe796fe9316484955e80d9ccae63e71ae06bdd7a871
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a7A08.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a7A08.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 454f23a4fa087e44299511e0fe65967414916c3bbffadf352d4958a6e592db60
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a8004.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8004.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 61bc72b34327431848fd4d179a711455ab212ca1c0b5d69e5b510063eeaccc33
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a813C.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a813C.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 0ef5e01555bbdd0aa5d9ad1ef79b9d7330247d0d06578c44ae655d6711029ba5
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      $$a8553.bat
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a8553.bat
                                                                                                                                                                                                                                                                                                      • Size 722B
                                                                                                                                                                                                                                                                                                      • SHA256 c5657f58c87fb482673bcd4a2ea590f809644a76142db6365b8f762407a26ddf
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.9MB
                                                                                                                                                                                                                                                                                                      • SHA256 28001d0e322353af338b82c4276d6cf35906948540df95378f741848b094d0f4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.9MB
                                                                                                                                                                                                                                                                                                      • SHA256 8912be5d036b7d0fc041b909a23efbb95a22c816f8a450b8165b9040e427319f
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                                                      • SHA256 611b9dfdd6754bff02582a0f66f3ad7eb398f3ea127ad5f4432746dd4c719321
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                                                      • SHA256 1fbe7f208d96a55a5160b97526aff29e68399654a35d3d9f57b8d856bc2d0544
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.7MB
                                                                                                                                                                                                                                                                                                      • SHA256 6c3adedfb68f2d52e168a6c3bb623c8993394bd3708d9fc40ca81bfb9ba80137
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 f1883acc2760a89a0cb446d486b8b4319847502c0ce9f4d07b46e7ba99eef695
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.9MB
                                                                                                                                                                                                                                                                                                      • SHA256 bfa1990efe0f81f2b961354ad01d7e32f2c369b73ded9a2fae61a10f29d32dbd
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                                                      • SHA256 5f3c0be7f425d82f871d6235f3731b4df64242159f08aeb9dc7185c46fb7c674
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                                                      • SHA256 cf54150009eda45dc9c76320767d693653446c3430ccf4b15d83db9963cdfa1d
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 9263044b8922b078cc329f4513fe86c16b0ec4022d1589f0d305c2c08b7472f7
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.6MB
                                                                                                                                                                                                                                                                                                      • SHA256 b7a9c5ee56fc26015319ebaff86f7bb9a80dbd8bd7daee18c5ff76f12d9021a6
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 6.0MB
                                                                                                                                                                                                                                                                                                      • SHA256 b7e62d1d45281f7583d353103bfc4c9191f8b9e092ccf0edcb421b10d8930935
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.8MB
                                                                                                                                                                                                                                                                                                      • SHA256 db409704a9cb504f4a54831bc348357fbbc302521dfb085ebbda778b94771ca0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                                                                                      • SHA256 70eff9dae516aef75652d1d88c7250e40735562017b81b6e6546338680d8d3b0
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.9MB
                                                                                                                                                                                                                                                                                                      • SHA256 20111bc90c47992f49002bdba85a55ff954e54ef7d282efc37a8a4a81515e9a2
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.4MB
                                                                                                                                                                                                                                                                                                      • SHA256 b39fbebfbf476bf2f935a4c338159c792d737a959b47a427171d758c72cb22a2
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                                                                                      • SHA256 b86779e7e172ad4c7e3f8dc7e44d2e63c3a4c80faaa8984efdf0d7d23b041cc4
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b22c9e3d0fae9d72ced81e466a644f4ac69a5c1f4bbd137ec8721cc6f2e77b99.exe.exe
                                                                                                                                                                                                                                                                                                      • Size 5.5MB
                                                                                                                                                                                                                                                                                                      • SHA256 d06f654e9e282c3784a1237d35572be4b2766145b159bdd23b9d949a176c869a
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Dll.dll
                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                                                                                      • Size 68KB
                                                                                                                                                                                                                                                                                                      • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      Logo1_.exe
                                                                                                                                                                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      _desktop.ini
                                                                                                                                                                                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-2091445952-3649787497-104050984-1000\_desktop.ini
                                                                                                                                                                                                                                                                                                      • Size 9B
                                                                                                                                                                                                                                                                                                      • SHA256 918b1655c9319d78d9f5801608ae25b42e9cbb99cfe2671ee37ac122a938d764
                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                      memory/216-2930-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/548-3050-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/552-2528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/652-2975-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/772-2574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/808-2714-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/896-2805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1004-2662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1028-2785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1068-3131-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1092-2686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1108-2500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1108-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1108-2021-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1108-442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1132-2860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1140-2810-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1156-2895-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1220-2602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1228-2955-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1344-2666-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1520-2970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1524-3010-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1528-2749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1536-2630-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1600-2541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1628-2800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1656-53-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1692-3065-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1708-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1724-3121-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1772-2890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1908-2561-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1928-2835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/1940-3136-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2016-2765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2032-19-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2124-2654-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2300-3141-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2312-2488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2356-2995-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2360-3126-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2552-3146-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2580-2690-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2604-2729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2704-2945-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2716-3015-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2772-2870-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2804-2474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2824-2545-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2840-2775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2848-2920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2860-2734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2932-2694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2952-2658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/2960-2626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3040-3116-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3044-69-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3056-2614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3120-2739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3152-1214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3160-3035-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3188-1723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3232-2875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3236-2598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3332-2634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3352-2915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3364-2754-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3372-2820-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3496-2622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3516-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3632-2840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3696-2985-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3732-3040-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3788-3020-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3824-2578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3840-1904-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3848-2825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/3960-2512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4000-2682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4024-2744-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4100-2724-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4140-2650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4164-3080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4196-2910-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4224-2670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4288-2885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4324-2582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4328-2850-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4336-3166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4384-2990-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4392-3161-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4408-3005-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4420-2795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4436-2646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4444-3075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4468-2586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4484-2562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4484-2511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4508-2935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4588-2537-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4600-2618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4628-2719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4636-2606-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4648-2594-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4656-2710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4684-2815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4692-2590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4696-2940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4724-2642-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4744-3085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4756-2557-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4768-2553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4792-2678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4840-2855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4852-3025-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4932-201-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4936-2925-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4968-3030-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/4984-2706-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5048-2830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5064-2780-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5084-2770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5088-2760-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5156-3060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5196-3055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5208-3101-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5220-28-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5248-3096-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5296-2549-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5300-3045-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5448-2702-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5476-3091-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5524-2865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5536-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5536-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5548-2698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5564-2905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5568-2570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5604-2965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5608-2960-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5628-2880-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5644-3156-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5760-3106-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5780-2674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5804-2790-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5816-3111-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5832-3070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5836-2519-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5852-2495-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5868-2900-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5900-2950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5908-2566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5912-3151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5916-2845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5944-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/5952-3000-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6104-2481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6116-2638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                                                                                                      memory/6124-2980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                                                      Download